Assume I have a laptop with ubuntu installed and two users abc and root. Both users are password protected. It is possible to reset root password using live CD or USB using chroot which would mean that if someone stole my laptop or held it for sometime, he could reset my user password and get all my information.
If it is possible then how secure is ubuntu and how secure are my files and information?
Even BIOS firmware can be flashed in case I protect it with password.
This is actually OS independent. If an attacker has physical access to your machine, then that machine is compromised. Period. This has nothing to do with what operating system you are using, it is true for all of them.
The only way to protect yourself from that (and it is also imperfect) is to encrypt your data. User passwords fail miserably since, as you point out, it is trivial to boot into a different system. When that happens, your data is under the control of this other OS, and the user passwords of your original system are completely irrelevant.
