CVE Details
CVE-2015-3246
Red Hat Libuser Race Condition Vulnerability
Published: 2026-08-26
CVSS: 5.1 MEDIUM
Product: Red Hat Libuser
Due Date: 2026-09-09
Red Hat libuser contains a race condition vulnerability that allows authenticated local users to corrupt the /etc/passwd file to cause a denial of service or privilege escalation.
GitHub PoC
Warning: GitHub PoC repositories are unverified. Some may be fake
or contain malware. Use caution and review code before running anything.
No GitHub PoC data.
FIRST EPSS
EPSS estimates the probability of exploitation in the next 30 days. Higher values indicate higher likelihood of real-world exploitation.
Timeline
CVE Stalker
KEV
MITRE
GitHub
FIRST (EPSS)
MITRE
CVSS
SSVC
References
Show Raw Data
| Key | Remaining Key | Value |
|---|---|---|
| containers > | cna > affected > 0 > product | n/a |
| containers > | cna > affected > 0 > vendor | n/a |
| containers > | cna > affected > 0 > versions > 0 > status | affected |
| containers > | cna > affected > 0 > versions > 0 > version | n/a |
| containers > | cna > datePublic | 2015-07-23T00:00:00.000Z |
| containers > | cna > descriptions > 0 > lang | en |
| containers > | cna > descriptions > 0 > value | libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /etc/passwd, which allows local users to cause a denial of service (inconsistent file state) by causing an error during the modification. NOTE: this issue can be combined with CVE-2015-3245 to gain privileges. |
| containers > | cna > problemTypes > 0 > descriptions > 0 > description | n/a |
| containers > | cna > problemTypes > 0 > descriptions > 0 > lang | en |
| containers > | cna > problemTypes > 0 > descriptions > 0 > type | text |
| containers > | cna > providerMetadata > dateUpdated | 2018-05-19T09:57:01.000Z |
| containers > | cna > providerMetadata > orgId | 53f830b8-0a3f-465b-8143-3b8a9948e749 |
| containers > | cna > providerMetadata > shortName | redhat |
| containers > | cna > references > 0 > name | 76022 |
| containers > | cna > references > 0 > tags > 0 | vdb-entry |
| containers > | cna > references > 0 > tags > 1 | x_refsource_BID |
| containers > | cna > references > 0 > url | http://www.securityfocus.com/bid/76022 |
| containers > | cna > references > 1 > name | FEDORA-2015-12301 |
| containers > | cna > references > 1 > tags > 0 | vendor-advisory |
| containers > | cna > references > 1 > tags > 1 | x_refsource_FEDORA |
| containers > | cna > references > 1 > url | http://lists.fedoraproject.org/pipermail/package-announce/2015-July/162947.html |
| containers > | cna > references > 2 > name | 44633 |
| containers > | cna > references > 2 > tags > 0 | exploit |
| containers > | cna > references > 2 > tags > 1 | x_refsource_EXPLOIT-DB |
| containers > | cna > references > 2 > url | https://www.exploit-db.com/exploits/44633/ |
| containers > | cna > references > 3 > tags > 0 | x_refsource_CONFIRM |
| containers > | cna > references > 3 > url | https://access.redhat.com/articles/1537873 |
| containers > | cna > references > 4 > name | RHSA-2015:1482 |
| containers > | cna > references > 4 > tags > 0 | vendor-advisory |
| containers > | cna > references > 4 > tags > 1 | x_refsource_REDHAT |
| containers > | cna > references > 4 > url | http://rhn.redhat.com/errata/RHSA-2015-1482.html |
| containers > | cna > references > 5 > name | FEDORA-2015-12064 |
| containers > | cna > references > 5 > tags > 0 | vendor-advisory |
| containers > | cna > references > 5 > tags > 1 | x_refsource_FEDORA |
| containers > | cna > references > 5 > url | http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163044.html |
| containers > | cna > references > 6 > name | openSUSE-SU-2015:1332 |
| containers > | cna > references > 6 > tags > 0 | vendor-advisory |
| containers > | cna > references > 6 > tags > 1 | x_refsource_SUSE |
| containers > | cna > references > 6 > url | http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00000.html |
| containers > | cna > references > 7 > tags > 0 | x_refsource_MISC |
| containers > | cna > references > 7 > url | https://www.qualys.com/2015/07/23/cve-2015-3245-cve-2015-3246/cve-2015-3245-cve-2015-3246.txt |
| containers > | cna > references > 8 > name | 1033040 |
| containers > | cna > references > 8 > tags > 0 | vdb-entry |
| containers > | cna > references > 8 > tags > 1 | x_refsource_SECTRACK |
| containers > | cna > references > 8 > url | http://www.securitytracker.com/id/1033040 |
| containers > | cna > references > 9 > name | RHSA-2015:1483 |
| containers > | cna > references > 9 > tags > 0 | vendor-advisory |
| containers > | cna > references > 9 > tags > 1 | x_refsource_REDHAT |
| containers > | cna > references > 9 > url | http://rhn.redhat.com/errata/RHSA-2015-1483.html |
| containers > | adp > 0 > providerMetadata > orgId | af854a3a-2127-422b-91ae-364da2661108 |
| containers > | adp > 0 > providerMetadata > shortName | CVE |
| containers > | adp > 0 > providerMetadata > dateUpdated | 2024-08-06T05:39:32.107Z |
| containers > | adp > 0 > title | CVE Program Container |
| containers > | adp > 0 > references > 0 > name | 76022 |
| containers > | adp > 0 > references > 0 > tags > 0 | vdb-entry |
| containers > | adp > 0 > references > 0 > tags > 1 | x_refsource_BID |
| containers > | adp > 0 > references > 0 > tags > 2 | x_transferred |
| containers > | adp > 0 > references > 0 > url | http://www.securityfocus.com/bid/76022 |
| containers > | adp > 0 > references > 1 > name | FEDORA-2015-12301 |
| containers > | adp > 0 > references > 1 > tags > 0 | vendor-advisory |
| containers > | adp > 0 > references > 1 > tags > 1 | x_refsource_FEDORA |
| containers > | adp > 0 > references > 1 > tags > 2 | x_transferred |
| containers > | adp > 0 > references > 1 > url | http://lists.fedoraproject.org/pipermail/package-announce/2015-July/162947.html |
| containers > | adp > 0 > references > 2 > name | 44633 |
| containers > | adp > 0 > references > 2 > tags > 0 | exploit |
| containers > | adp > 0 > references > 2 > tags > 1 | x_refsource_EXPLOIT-DB |
| containers > | adp > 0 > references > 2 > tags > 2 | x_transferred |
| containers > | adp > 0 > references > 2 > url | https://www.exploit-db.com/exploits/44633/ |
| containers > | adp > 0 > references > 3 > tags > 0 | x_refsource_CONFIRM |
| containers > | adp > 0 > references > 3 > tags > 1 | x_transferred |
| containers > | adp > 0 > references > 3 > url | https://access.redhat.com/articles/1537873 |
| containers > | adp > 0 > references > 4 > name | RHSA-2015:1482 |
| containers > | adp > 0 > references > 4 > tags > 0 | vendor-advisory |
| containers > | adp > 0 > references > 4 > tags > 1 | x_refsource_REDHAT |
| containers > | adp > 0 > references > 4 > tags > 2 | x_transferred |
| containers > | adp > 0 > references > 4 > url | http://rhn.redhat.com/errata/RHSA-2015-1482.html |
| containers > | adp > 0 > references > 5 > name | FEDORA-2015-12064 |
| containers > | adp > 0 > references > 5 > tags > 0 | vendor-advisory |
| containers > | adp > 0 > references > 5 > tags > 1 | x_refsource_FEDORA |
| containers > | adp > 0 > references > 5 > tags > 2 | x_transferred |
| containers > | adp > 0 > references > 5 > url | http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163044.html |
| containers > | adp > 0 > references > 6 > name | openSUSE-SU-2015:1332 |
| containers > | adp > 0 > references > 6 > tags > 0 | vendor-advisory |
| containers > | adp > 0 > references > 6 > tags > 1 | x_refsource_SUSE |
| containers > | adp > 0 > references > 6 > tags > 2 | x_transferred |
| containers > | adp > 0 > references > 6 > url | http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00000.html |
| containers > | adp > 0 > references > 7 > tags > 0 | x_refsource_MISC |
| containers > | adp > 0 > references > 7 > tags > 1 | x_transferred |
| containers > | adp > 0 > references > 7 > url | https://www.qualys.com/2015/07/23/cve-2015-3245-cve-2015-3246/cve-2015-3245-cve-2015-3246.txt |
| containers > | adp > 0 > references > 8 > name | 1033040 |
| containers > | adp > 0 > references > 8 > tags > 0 | vdb-entry |
| containers > | adp > 0 > references > 8 > tags > 1 | x_refsource_SECTRACK |
| containers > | adp > 0 > references > 8 > tags > 2 | x_transferred |
| containers > | adp > 0 > references > 8 > url | http://www.securitytracker.com/id/1033040 |
| containers > | adp > 0 > references > 9 > name | RHSA-2015:1483 |
| containers > | adp > 0 > references > 9 > tags > 0 | vendor-advisory |
| containers > | adp > 0 > references > 9 > tags > 1 | x_refsource_REDHAT |
| containers > | adp > 0 > references > 9 > tags > 2 | x_transferred |
| containers > | adp > 0 > references > 9 > url | http://rhn.redhat.com/errata/RHSA-2015-1483.html |
| containers > | adp > 1 > metrics > 0 > cvssV3_1 > scope | UNCHANGED |
| containers > | adp > 1 > metrics > 0 > cvssV3_1 > version | 3.1 |
| containers > | adp > 1 > metrics > 0 > cvssV3_1 > baseScore | 5.1 |
| containers > | adp > 1 > metrics > 0 > cvssV3_1 > attackVector | LOCAL |
| containers > | adp > 1 > metrics > 0 > cvssV3_1 > baseSeverity | MEDIUM |
| containers > | adp > 1 > metrics > 0 > cvssV3_1 > vectorString | CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H |
| containers > | adp > 1 > metrics > 0 > cvssV3_1 > integrityImpact | NONE |
| containers > | adp > 1 > metrics > 0 > cvssV3_1 > userInteraction | NONE |
| containers > | adp > 1 > metrics > 0 > cvssV3_1 > attackComplexity | HIGH |
| containers > | adp > 1 > metrics > 0 > cvssV3_1 > availabilityImpact | HIGH |
| containers > | adp > 1 > metrics > 0 > cvssV3_1 > privilegesRequired | NONE |
| containers > | adp > 1 > metrics > 0 > cvssV3_1 > confidentialityImpact | NONE |
| containers > | adp > 1 > metrics > 1 > other > type | ssvc |
| containers > | adp > 1 > metrics > 1 > other > content > id | CVE-2015-3246 |
| containers > | adp > 1 > metrics > 1 > other > content > role | CISA Coordinator |
| containers > | adp > 1 > metrics > 1 > other > content > options > 0 > Exploitation | active |
| containers > | adp > 1 > metrics > 1 > other > content > options > 1 > Automatable | no |
| containers > | adp > 1 > metrics > 1 > other > content > options > 2 > Technical Impact | partial |
| containers > | adp > 1 > metrics > 1 > other > content > version | 2.0.3 |
| containers > | adp > 1 > metrics > 1 > other > content > timestamp | 2026-08-26T17:44:11.022663Z |
| containers > | adp > 1 > references > 0 > url | https://blog.talosintelligence.com/uat-10147-chinese-speaking-adversary-integrates-agentic-ai-into-post-compromise-operations/ |
| containers > | adp > 1 > references > 0 > tags > 0 | third-party-advisory |
| containers > | adp > 1 > references > 1 > url | https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-3246 |
| containers > | adp > 1 > references > 1 > tags > 0 | government-resource |
| containers > | adp > 1 > problemTypes > 0 > descriptions > 0 > lang | en |
| containers > | adp > 1 > problemTypes > 0 > descriptions > 0 > type | CWE |
| containers > | adp > 1 > problemTypes > 0 > descriptions > 0 > cweId | CWE-367 |
| containers > | adp > 1 > problemTypes > 0 > descriptions > 0 > description | CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition |
| containers > | adp > 1 > title | CISA ADP Vulnrichment |
| containers > | adp > 1 > providerMetadata > orgId | 134c704f-9b21-4f2e-91b3-4a467353bcc0 |
| containers > | adp > 1 > providerMetadata > shortName | CISA-ADP |
| containers > | adp > 1 > providerMetadata > dateUpdated | 2026-08-26T17:44:58.382Z |
| cveMetadata > | assignerOrgId | 53f830b8-0a3f-465b-8143-3b8a9948e749 |
| cveMetadata > | assignerShortName | redhat |
| cveMetadata > | cveId | CVE-2015-3246 |
| cveMetadata > | datePublished | 2015-08-11T14:00:00.000Z |
| cveMetadata > | dateReserved | 2015-04-10T00:00:00.000Z |
| cveMetadata > | dateUpdated | 2026-08-26T17:44:58.382Z |
| cveMetadata > | state | PUBLISHED |
| dataType | CVE_RECORD | |
| dataVersion | 5.2 |