libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /etc/passwd, which allows local users to cause a denial of service (inconsistent file state) by causing an error during the modification. NOTE: this issue can be combined with CVE-2015-3245 to gain privileges.
High 7.4Actively exploited
CVE-2015-3246
Red Hat Libuser — Race Condition.
libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /etc/passwd, which allows local users to cause a denial of service (inconsistent file state)…
Published Updated Source NVD and CISA KEV
CVSS 3.1
7.4
AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploit chance, 30 days
8.5%
Higher than 95% of all CVEs (EPSS)
Status
Actively exploited
On CISA KEV since 26 Aug 2026
Patch
Unknown
Check the vendor advisory
What happened
What to do
- 01Check whether you run Red Hat Libuser, and which version.
- 02Follow the vendor advisory for a fix or a workaround.
- 03Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CISA deadlineUS federal agencies must remediate by
References
- NVDnvd.nist.gov
- CISA KEVcisa.gov
- Vendor advisoryrhn.redhat.com
- Vendor advisoryrhn.redhat.com
- Mitigationaccess.redhat.com
- Third-party advisorysecurityfocus.com
- Third-party advisorysecuritytracker.com
- Third-party advisoryexploit-db.com
- Exploitqualys.com
- Mailing listlists.opensuse.org
- Reference (may be offline)lists.fedoraproject.org
- Reference (may be offline)lists.fedoraproject.org
Timeline · UTC
- Published to NVD
- Added to CISA KEV
- CISA remediation deadline
- NVD record updated
Also actively exploited
Other CVEs from Red Hat
9 more CVEs, 1 actively exploited
7.8Red Hat Automatic Bug Reporting Tool — Privilege Escalation.ExploitedEPSS 5.0%9.1Red Hat OpenShift AI (RHOAI) — authorization bypass.EPSS 0.2%9.9Red Hat StreamsHub Console for Apache Kafka® — privilege escalation.EPSS 0.3%9.1Red Hat Red Hat build of Quarkus 3.27.6.redhat — This vulnerability allows unauthenticated attackers to bypass security controls on generated…EPSS 0.4%9.3Red Hat Build of Podman Desktop — path traversal.EPSS 0.2%9.0Red Hat Red Hat Directory Server 11 — The server does not discard plaintext bytes already buffered from a client connection when…EPSS 0.4%