--- id: "CVE-2015-3246" kind: "vulnerability" aliases: ["CVE-2015-3246"] title: "libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly\u2026" severity: "high" cvss: 7.4 epss: null exploited: true status: "open" category: "infrastructure" products: [{"name": "Red Hat Libuser", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "libuser", "fixed": ["0.56.13-8.el6_7", "0.60-7.el7_1"], "affected": "RHEL 5 (all); RHEL 6 < 0.56.13-8.el6_7; RHEL 7 < 0.60-7.el7_1", "ecosystem": "rpm"}, {"name": "redhat enterprise linux", "fixed": [], "affected": "= 5.0", "ecosystem": "vendor"}, {"name": "redhat enterprise linux", "fixed": [], "affected": "= 6.0", "ecosystem": "vendor"}, {"name": "redhat enterprise linux", "fixed": [], "affected": "= 7.0", "ecosystem": "vendor"}, {"name": "opensuse", "fixed": [], "affected": "= 13.2", "ecosystem": "vendor"}, {"name": "libuser project libuser", "fixed": ["0.56.13-8"], "affected": "< 0.56.13-8", "ecosystem": "vendor"}, {"name": "libuser project libuser", "fixed": ["0.60-7"], "affected": ">= 0.60, < 0.60-7", "ecosystem": "vendor"}] ecosystems: ["rpm", "vendor"] tags: ["exploited", "infrastructure", "libuser", "linux", "local-privilege-escalation", "red-hat", "rhel", "self-hosted"] not_affected_if: ["managed-hosting", "no-local-user-access", "no-local-users"] published_at: "2015-08-11T14:59:07+00:00" first_seen_at: "2026-10-23T19:11:51+00:00" updated_at: "2026-10-23T23:44:52+00:00" sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2015-3246", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T21:40:21+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-3246", "first_seen_at": "2026-10-23T23:44:52+00:00"}] --- # libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly… Race condition in libuser: it edits /etc/passwd in place instead of writing a temp copy and renaming it. A local user can run an app built on libuser (e.g. userhelper, chfn, chsh) to corrupt the file. The result is denial of service or root privilege escalation. Local access is required. CISA KEV lists it as exploited. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:Red Hat Libuser affected ? fixed ? - rpm:libuser affected RHEL 5 (all); RHEL 6 < 0.56.13-8.el6_7; RHEL 7 < 0.60-7.el7_1 fixed 0.56.13-8.el6_7, 0.60-7.el7_1 - vendor:redhat enterprise linux affected = 5.0 fixed ? - vendor:redhat enterprise linux affected = 6.0 fixed ? - vendor:redhat enterprise linux affected = 7.0 fixed ? - vendor:opensuse affected = 13.2 fixed ? - vendor:libuser project libuser affected < 0.56.13-8 fixed 0.56.13-8 - vendor:libuser project libuser affected >= 0.60, < 0.60-7 fixed 0.60-7 ## How to check On RHEL/CentOS/Oracle Linux run: rpm -q libuser. Vulnerable if older than 0.56.13-8.el6_7 (RHEL6) or 0.60-7.el7_1 (RHEL7). All RHEL5 libuser versions are affected. ## Fix RHEL6: yum update libuser to 0.56.13-8.el6_7 or later (RHSA-2015:1482). RHEL7: update to 0.60-7.el7_1 or later (RHSA-2015:1483). RHEL5: no fix planned; as a mitigation, add pam_rootok / pam_warn / pam_deny rules to /etc/pam.d/chfn and /etc/pam.d/chsh so unprivileged users cannot use them. ## Timeline - 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2015-3246 - 2026-10-23T21:40:21+00:00 analyst — Read Red Hat article 1537873, RHSA-2015:1482 (via LWN), ELSA-2015-1483 mirror, and Red Hat CVE page. Fixed: RHEL6 libuser-0.56.13-8.el6_7, RHEL7 libuser-0.60-7.el7_1 (RHSA-2015:1483; version read on the Oracle mirror). RHEL5 is affected and will not be fixed. KEV lists it as exploited. I did not look for a public PoC or social discussion; the issue is from 2015 and was reported by Qualys. - 2026-10-23T23:44:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2015-3246 ## Documents - [advisory] libuser vulnerabilities (CVE-2015-3245 and CVE-2015-3246) - Red Hat https://access.redhat.com/articles/1537873 - [fix] RHSA-2015:1482 libuser (RHEL 6) https://lwn.net/Articles/652340/ - [fix] ELSA-2015-1483 libuser 0.60-7.el7_1 (mirrors RHSA-2015:1483) https://linux.oracle.com/errata/ELSA-2015-1483.html - [mitigation] CVE-2015-3246 Red Hat CVE page (RHEL5 statement, mitigation) https://access.redhat.com/security/cve/cve-2015-3246 ## From the sources Red Hat libuser contains a race condition vulnerability that allows authenticated local users to corrupt the /etc/passwd file to cause a denial of service or privilege escalation. CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_