CVE-2015-3246
KEVRed Hat Libuser Race Condition Vulnerability
Description
Red Hat libuser contains a race condition vulnerability that allows authenticated local users to corrupt the /etc/passwd file to cause a denial of service or privilege escalation.
libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /etc/passwd, which allows local users to cause a denial of service (inconsistent file state) by causing an error during the modification. NOTE: this issue can be combined with CVE-2015-3245 to gain privileges.
CVSS 3.1 vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HPublishedAug 11, 2015
Last modifiedOct 2, 2026
Added to KEVAug 26, 2026
Remediation dueSep 9, 2026
References
- lists.fedoraproject.org/pipermail/package-announce/2015-August/163044.htmlBroken Link
- lists.fedoraproject.org/pipermail/package-announce/2015-July/162947.htmlBroken Link
- lists.opensuse.org/opensuse-security-announce/2015-08/msg00000.htmlMailing ListThird Party Advisory
- rhn.redhat.com/errata/RHSA-2015-1482.htmlVendor Advisory
- rhn.redhat.com/errata/RHSA-2015-1483.htmlVendor Advisory
- securityfocus.com/bid/76022Third Party Advisory
- securitytracker.com/id/1033040Third Party Advisory
- access.redhat.com/articles/1537873MitigationVendor Advisory
- exploit-db.com/exploits/44633/Third Party AdvisoryVDB Entry
- qualys.com/2015/07/23/cve-2015-3245-cve-2015-3246/cve-2015-3245-cve-2015-3246.txtExploit
- blog.talosintelligence.com/uat-10147-chinese-speaking-adversary-integrates-agentic-ai-into-post-compromise-operations/Third Party Advisory
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-3246US Government Resource
0 recent articles mention this CVE
68
Risk assessment · High
Actively exploited. Patch immediately.
- Exploitation
- Confirmed in the wild (CISA KEV)
- Federal remediation deadline
- Overdue by 47 days
- CVSS
- 7.4 HIGH
- EPSS (30-day exploit probability)
- 8.5% · top 5% of all CVEs
- Weakness
- CWE-264
- Preconditions
- No privileges and no user interaction
Recommended actions
- 1.Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- 2.Treat as emergency change: patch or isolate internet-facing instances first.
- 3.Hunt for compromise: review logs for the disclosure window, not just from the patch date.
Assessment is derived automatically from the live signals above; verify against your own asset inventory.