CVE-2015-3246: libuser /etc/passwd race via userhelper (local root, with CVE-2015-3245)
Exploited in the wild High 7.4 EPSS 8.5%
libuser before 0.56.13-8 (RHEL 6) and 0.60 before 0.60-7 (RHEL 7), as used by the userhelper program from the usermode package, modifies /etc/passwd in place instead of via a temporary copy and rename. A local user can trigger an error mid-write to corrupt the file, and combined with CVE-2015-3245 (newline injection in userhelper chfn) gain root. Fixed by Red Hat in July 2015; CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-26.
- CVE-2015-3246CVE identifier
- 7.4CVSS 3.1 base score (high)
- 2026-08-26added to CISA's exploited list (US federal deadline 2026-09-09)
- 8.5%EPSS: chance of exploitation in the next 30 days (higher than 95% of CVEs)
- 2015-08-11published
What do these terms mean? CVE · CVSS score · exploited (KEV) · EPSS · backported fix · all terms
What to do now
- Check whether you run the affected software and which version (commands below).
- Install the fixed version for your system: see “Patch it” below.
- No service restart needed; the fixed library is used the next time userhelper/chfn/chsh run.
- If you cannot patch today, apply the temporary mitigation below and patch as soon as possible.
- Because this flaw is being exploited, also check the server for signs of compromise.
Affected and fixed versions
Affected:
- libuser before 0.56.13-8
- libuser 0.60 before 0.60-7
Fixed in:
- libuser 0.56.13-8 (RHEL 6)
- libuser 0.60-7 (RHEL 7)
Am I affected?
rpm -q libuser usermode
dpkg -l libuser | grep ^iiPatch it
Use the commands for your system. Distribution packages often keep an older version number with the fix backported, so compare with the fixed package versions in the table below, not only with the upstream version.
Debian
sudo apt update
sudo apt install --only-upgrade libuserRHEL, AlmaLinux, Rocky, Oracle
sudo yum update libuserGeneral update steps for every system are on the Linux and Unix & BSD pages; after updating, see which services to restart.
Fix status in Linux distributions
| Release | Package | Status | Fixed version / advisory |
|---|---|---|---|
| Debian 12 | libuser | fixed | 1:0.62~dfsg-0.1 |
| Debian 13 | libuser | fixed | 1:0.62~dfsg-0.1 |
| Debian testing | libuser | fixed | 1:0.62~dfsg-0.1 |
| Ubuntu 18.04 (ESM) | libuser | not affected | |
| Ubuntu 20.04 (ESM) | libuser | not affected | |
| Ubuntu 22.04 | libuser | not affected | |
| Ubuntu 24.04 | libuser | not affected | |
| Ubuntu 25.10 | libuser | not planned | |
| Ubuntu 26.04 | libuser | not affected | |
| Ubuntu 26.10 | libuser | not affected | |
| Red Hat Enterprise Linux 7 | libuser-0:0.60-7.ael7b_1 | fixed | RHSA-2015:1483 |
| Red Hat Enterprise Linux 6 | libuser-0:0.56.13-8.el6_7 | fixed | RHSA-2015:1482 |
| Red Hat Enterprise Linux 5 | libuser | will not fix | |
| RHEL 7 | libuser | fixed | 0.60-7.ael7b_1 (RHSA-2015:1483) |
| RHEL 6 | libuser | fixed | 0.56.13-8.el6_7 (RHSA-2015:1482) |
| Debian 7 (wheezy) | libuser | fixed | 1:0.56.9.dfsg.1-1.2+deb7u1 (DLA-468-1) |
| Debian 12 / 13 | libuser | fixed | not affected (0.64 packages) |
From the Debian security tracker, Ubuntu CVE tracker and Red Hat Security Data API, refreshed every few hours.
If you cannot patch yet
- Where libuser cannot be updated, Red Hat advises blocking non-root use of chfn and chsh by adding pam_warn and pam_deny to /etc/pam.d/chfn and /etc/pam.d/chsh so each contains: auth sufficient pam_rootok.so auth required pam_warn.so auth required pam_deny.so auth include system-auth account include system-auth password include system-auth session include system-auth
Look for signs of exploitation
- With the PAM workaround in place, attempts by unprivileged users to use chfn/chsh (and userhelper) fail and are logged, by default in /var/log/secure (Red Hat).
CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://access.redhat.com/articles/1537873 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2015-3246
Related vulnerabilities
Sources
- Red Hat: libuser vulnerabilities (CVE-2015-3245 and CVE-2015-3246)
- Red Hat CVE-2015-3246 data
- Debian security tracker CVE-2015-3246
- CVE record CVE-2015-3246
- https://www.exploit-db.com/exploits/44633/
- https://www.qualys.com/2015/07/23/cve-2015-3245-cve-2015-3246/cve-2015-3245-cve-2015-3246.txt
- CVE-2015-3246 on CVE.org
- CVE-2015-3246 on NVD
- CISA Known Exploited Vulnerabilities catalog
Page generated automatically from official sources on 2026-11-03 18:05 UTC and reviewed by an editor. Always confirm with your vendor's advisory.