CVE-2015-3246
Red Hat Libuser Race Condition Vulnerability
Published Aug 11, 2015 · updated Oct 2, 2026 · Red Hat Libuser
libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /etc/passwd, which allows local users to cause a denial of service (inconsistent file state) by causing an error during the modification. NOTE: this issue can be combined with CVE-2015-3245 to gain privileges.
Timeline
Detection, updates, and resolution for this record.
Aug 11, 2015 · Catalog
Detected
libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /etc/passwd, which allows local users to cause a denial of service (inconsistent file state) by causing an error during the modification. NOTE: this issue can be combined with CVE-2015-3245 to gain privileges.
Aug 26, 2026 · CISA KEV
Known exploited
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating
Sep 9, 2026 · CISA KEV
Remediation due
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating
Oct 2, 2026 · Catalog
Updated
libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /etc/passwd, which allows local users to cause a denial of service (inconsistent file state) by causing an error during the modification. NOTE: this issue can be combined with CVE-2015-3245 to gain privileges.
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CISA due date Sep 9, 2026
Affected
- cpe libuser project/libuserversion unspecified
- cpe opensuse/opensuse13.2
- cpe redhat/enterprise linux5.0
- cpe redhat/enterprise linux6.0
- cpe redhat/enterprise linux7.0
- vendor Red Hat Libuserversion unspecified
Sources
- CISA KEVCVE-2015-3246
Red Hat libuser contains a race condition vulnerability that allows authenticated local users to corrupt the /etc/passwd file to cause a denial of service or privilege escalation.
cisa.gov - CVE.orgCVE-2015-3246
Official CVE identifier
cve.org - FIRST EPSSCVE-2015-3246
30-day exploitation probability 8.4%
first.org - Exploit Database37706
Public archive entry. The exploit body is not stored here.
exploit-db.com - Exploit Database44633
Public archive entry. The exploit body is not stored here.
exploit-db.com - Metasploit Modulesexploit_linux/local/libuser_roothelper_priv_esc
Public module reference (great). Module source is not copied into this catalog.
rapid7.com - NIST NVDCVE-2015-3246
libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /etc/passwd, which allows local users to cause a denial of service (inconsistent file state) by causing an error during the modification. NOTE: this issue
nvd.nist.gov