Skip to content

CVE-2015-3246 libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /etc/passwd, which allows local users to cause a denial of service (incons...

HighCVSS 7.2 EPSS 8.5% CISA KEV added 2026-08-26 · due 2026-09-09 Exploited in the wild Framework module Public exploit PoC
Published
Updated
Exploit status
Exploited in the wild (confirmed)
Sign in for asset impact Search another CVE

Description

libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /etc/passwd, which allows local users to cause a denial of service (inconsistent file state) by causing an error during the modification. NOTE: this issue can be combined with CVE-2015-3245 to gain privileges.

CISA Known Exploited Vulnerability

Date added
2026-08-26
Due date (FCEB)
2026-09-09
Ransomware use
Unknown

Required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Affected products

ProductAffected versionsFixed in
debian/libuser(Debian:12) < 1:0.62~dfsg-0.1 1:0.62~dfsg-0.1
debian/libuser(Debian:13) < 1:0.62~dfsg-0.1 1:0.62~dfsg-0.1
debian/libuser(Debian:14) < 1:0.62~dfsg-0.1 1:0.62~dfsg-0.1
redhat enterprise linux = 5.0 No fix listed
redhat enterprise linux = 6.0 No fix listed
redhat enterprise linux = 7.0 No fix listed
opensuse = 13.2 No fix listed
libuser project libuser < 0.56.13-8 0.56.13-8
libuser project libuser >= 0.60, < 0.60-7 0.60-7

References