{"id":"CVE-2015-3246","title":"libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /etc/passwd, which allows local users to cause a denial of service (inconsistent file state) by causing an erro…","summary":"libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /etc/passwd, which allows local users to cause a denial of service (inconsistent file state) by causing an erro…","severity":"high","cvss":7.4,"cvssVector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-264","CWE-367"],"vendor":"libuser_project","product":"libuser","affected":["enterprise_linux = 5.0","enterprise_linux = 6.0","enterprise_linux = 7.0","opensuse = 13.2","libuser < 0.56.13-8","libuser >= 0.60, < 0.60-7"],"patched":["libuser 0.60-7"],"published":"2015-08-11","updated":"2026-10-02","sourceUpdated":"2026-10-02T11:33:29.473","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2015-3246","references":[{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163044.html","label":"secalert@redhat.com"},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-July/162947.html","label":"secalert@redhat.com"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00000.html","label":"secalert@redhat.com"},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1482.html","label":"secalert@redhat.com"},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1483.html","label":"secalert@redhat.com"},{"url":"http://www.securityfocus.com/bid/76022","label":"secalert@redhat.com"},{"url":"http://www.securitytracker.com/id/1033040","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/articles/1537873","label":"secalert@redhat.com"},{"url":"https://www.exploit-db.com/exploits/44633/","label":"secalert@redhat.com"},{"url":"https://www.qualys.com/2015/07/23/cve-2015-3245-cve-2015-3246/cve-2015-3245-cve-2015-3246.txt","label":"secalert@redhat.com"},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163044.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-July/162947.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00000.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1482.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1483.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securityfocus.com/bid/76022","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securitytracker.com/id/1033040","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/articles/1537873","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.exploit-db.com/exploits/44633/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.qualys.com/2015/07/23/cve-2015-3245-cve-2015-3246/cve-2015-3245-cve-2015-3246.txt","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://blog.talosintelligence.com/uat-10147-chinese-speaking-adversary-integrates-agentic-ai-into-post-compromise-operations/","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-3246","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd","kev","in-the-wild","exploit-available","cve.org"],"epss":0.08503,"epssPercentile":0.95012,"kev":true,"kevDateAdded":"2026-08-26","kevDueDate":"2026-09-09","kevRansomware":false,"exploited":true,"exploits":{"exploitdb":true,"github":1,"githubRepos":["https://github.com/HORKimhab/CVE-2015-3246"],"metasploit":["exploit/linux/local/libuser_roothelper_priv_esc"],"checkedAt":"2026-10-27T16:38:16.104Z"},"exploitAvailable":true,"ssvc":{"exploitation":"active","automatable":"no","technicalImpact":"total","timestamp":"2026-08-27T03:56:43.101618Z"},"ingestedAt":"2026-08-26T18:47:53.340Z","slug":"CVE-2015-3246","body":"## Overview\n\nlibuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /etc/passwd, which allows local users to cause a denial of service (inconsistent file state) by causing an error during the modification. NOTE: this issue can be combined with CVE-2015-3245 to gain privileges.\n\n## Affected\n\n- `enterprise_linux = 5.0`\n- `enterprise_linux = 6.0`\n- `enterprise_linux = 7.0`\n- `opensuse = 13.2`\n- `libuser < 0.56.13-8`\n- `libuser >= 0.60, < 0.60-7`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `libuser 0.60-7`","depth":"abyssal","depthScore":67,"depthScoreParts":{"impact":40.7,"likelihood":1.7,"exploitation":25,"ransomware":0},"changes":[{"seq":214628,"id":"CVE-2015-3246","ts":1790884771783,"field":"cvss","old":"5.1","new":"7.4"},{"seq":214627,"id":"CVE-2015-3246","ts":1790884771783,"field":"severity","old":"medium","new":"high"}]}