libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /etc/passwd, w
Affects libuser as used by userhelper in the usermode package on Red Hat Enterprise Linux 6 and 7. The fix is the updated libuser packages from Red Hat's advisories.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Actively exploited
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- 3 on Exploit-DB
- Exploitation: active
- Automatable: no
- Technical impact: total
Summary
The libuser library and the userhelper program in the usermode package, used on Linux systems, can leave the system's user account file (/etc/passwd) in an inconsistent state. A local user can trigger this by causing an error during an account modification, which can cause a denial of service and, when combined with another flaw, may allow privilege escalation.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /etc/passwd, which allows local users to cause a denial of service (inconsistent file state) by causing an error during the modification. NOTE: this issue can be combined with CVE-2015-3245 to gain privileges.
Timeline
- Public exploit on Exploit-DB
EDB-37706, EDB-44633, EDB-44633
- CVE published
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- CISA SSVC assessment
Exploitation: active · Automatable: no · Technical impact: total
- CISA remediation deadline
Due date for US federal agencies to patch
- Record last updated
Affected versions
No affected packages have been listed by the sources.
References 12
securityfocus.com
lists.fedoraproject.org
access.redhat.com
rhn.redhat.com
lists.opensuse.org
securitytracker.com
Questions about CVE-2015-3246
What does this mean?
The flaw lets a local user who already has an account in /etc/passwd and knows its password modify that file directly, leaving it inconsistent and causing a local denial of service. Authenticated local users could also use it to escalate privileges to root.Source: access.redhat.com
Am I affected, and how do I check?
All versions of the libuser library included with Red Hat Enterprise Linux 6 and 7 are affected, including its use by the userhelper program in the usermode package. To check a system, look at the installed libuser and usermode package versions, for example with rpm -q libuser usermode, and compare them with Red Hat's advisories.Source: access.redhat.com
What should I do about it?
Install the updated libuser packages made available through the Red Hat advisories listed for this issue.Source: access.redhat.com
Is it being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2026-08-26, which means it has evidence of attacks. Public exploit code exists (Exploit-DB).Source: cisa.gov, cve.now feed data
What if there's no patch?
Add pam_warn and pam_deny rules to /etc/pam.d/chfn and /etc/pam.d/chsh to stop non-root users from using those vulnerable services until the updated packages are installed.Source: access.redhat.com