{"id":"CVE-2015-3246","url":"https://www.cyber-defence.io/tools/cve/CVE-2015-3246","generatedAt":"2026-10-31T22:33:40.211Z","title":"Red Hat Libuser Race Condition Vulnerability","description":"libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /etc/passwd, which allows local users to cause a denial of service (inconsistent file state) by causing an error during the modification. NOTE: this issue can be combined with CVE-2015-3245 to gain privileges.","published":"2015-08-11T14:59:07.000Z","lastModified":"2026-10-02T11:33:29.000Z","status":"Analyzed","sourceIdentifier":"secalert@redhat.com","cvss":{"version":"3.1","score":7.4,"severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},"cwe":["CWE-264","CWE-367"],"affected":["redhat/enterprise linux","opensuse/opensuse","libuser project/libuser"],"epss":{"score":0.08503,"percentile":0.95031,"date":"2026-10-30","history":[]},"kev":{"listed":true,"dateAdded":"2026-08-26","dueDate":"2026-09-09","knownRansomwareCampaignUse":"Unknown","notes":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.\nThis vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://access.redhat.com/articles/1537873 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2015-3246"},"exploits":{"count":2,"verified":true,"firstPublished":"2015-07-27","source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[{"edbId":44633,"kind":"exploit","title":"Libuser - 'roothelper' Local Privilege Escalation (Metasploit)","url":"https://www.exploit-db.com/exploits/44633","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/linux/local/44633.rb","file":"exploits/linux/local/44633.rb","published":"2018-05-16","added":"2018-05-16","updated":"2018-11-15","author":"Metasploit","type":"local","platform":"linux","port":null,"verified":true,"codes":["CVE-2015-3246","CVE-2015-3245"],"tags":"Local","aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":"https://raw.githubusercontent.com/rapid7/metasploit-framework/ed5f2bffa9223ea6005cc9f0bc336c796819ecc3/modules/exploits/linux/local/libuser_roothelper_priv_esc.rb"},{"edbId":37706,"kind":"exploit","title":"Libuser Library - Multiple Vulnerabilities","url":"https://www.exploit-db.com/exploits/37706","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/linux/dos/37706.txt","file":"exploits/linux/dos/37706.txt","published":"2015-07-27","added":"2015-07-27","updated":"2018-05-16","author":"Qualys Corporation","type":"dos","platform":"linux","port":null,"verified":true,"codes":["CVE-2015-3246","CVE-2015-3245","OSVDB-125264","OSVDB-125263"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":null}]},"verdict":{"level":"urgent","text":"Known to be exploited in the wild (CISA KEV, CISA remediation deadline 9 September 2026). Treat as an emergency change: patch or isolate now, then hunt for prior compromise."},"changes":[{"kind":"scored","label":"Newly scored","at":"2026-10-01T19:30:08.000Z","detail":{"from":"5.1","score":"7.4","severity":"HIGH","fromSeverity":"MEDIUM"},"summary":"Now scored CVSS 7.4 HIGH (was 5.1)."}],"references":[{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163044.html","tags":["Broken Link"],"source":"secalert@redhat.com"},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-July/162947.html","tags":["Broken Link"],"source":"secalert@redhat.com"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00000.html","tags":["Mailing List","Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1482.html","tags":["Vendor Advisory"],"source":"secalert@redhat.com"},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1483.html","tags":["Vendor Advisory"],"source":"secalert@redhat.com"},{"url":"http://www.securityfocus.com/bid/76022","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://www.securitytracker.com/id/1033040","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"https://access.redhat.com/articles/1537873","tags":["Mitigation","Vendor Advisory"],"source":"secalert@redhat.com"},{"url":"https://www.exploit-db.com/exploits/44633/","tags":["Third Party Advisory","VDB Entry"],"source":"secalert@redhat.com"},{"url":"https://www.qualys.com/2015/07/23/cve-2015-3245-cve-2015-3246/cve-2015-3245-cve-2015-3246.txt","tags":["Exploit"],"source":"secalert@redhat.com"},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163044.html","tags":["Broken Link"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-July/162947.html","tags":["Broken Link"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00000.html","tags":["Mailing List","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1482.html","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1483.html","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securityfocus.com/bid/76022","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securitytracker.com/id/1033040","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/articles/1537873","tags":["Mitigation","Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.exploit-db.com/exploits/44633/","tags":["Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.qualys.com/2015/07/23/cve-2015-3245-cve-2015-3246/cve-2015-3245-cve-2015-3246.txt","tags":["Exploit"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://blog.talosintelligence.com/uat-10147-chinese-speaking-adversary-integrates-agentic-ai-into-post-compromise-operations/","tags":["Third Party Advisory"],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-3246","tags":["US Government Resource"],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2015-3246","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}