Vulnpedia
← All CVEs

CVE-2015-3246

HIGH 7.4 KNOWN EXPLOITED PoC CATALOGUED ALL-YEARS

Published 2015-08-11 · Last modified 2026-10-01 · redhat · NVD: Analyzed

libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /etc/passwd, which allows local users to cause a denial of service (inconsistent file state) by causing an error during the modification. NOTE: this issue can be combined with CVE-2015-3245 to gain privileges.

ACTIVELY EXPLOITED

Confirmed exploited in the wild — in CISA KEV since 2026-08-26. Patch or mitigate now.

Exploitation likelihood

8.5%chance of exploitation in 30 days · 95th percentile

● In CISA KEV (2026-08-26)● Catalogued PoC◆ SSVC: exploitation active, automatable no

Impact if exploited

7.4CVSS 3.1 · HIGH · ADP

  • ConfidentialityHigh
  • IntegrityHigh
  • AvailabilityHigh

What an attacker needs

  • ⚠Access: Requires local access to the host
  • ✓Privileges: No account or privileges required
  • ✓User interaction: No user interaction needed
  • ⚠Complexity: Needs a race window or specific setup

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

Public PoC or exploit resources are catalogued below.

Listed by the named source; Vulnpedia has not tested these resources.

PoC data: JSON

Resource commands

searchsploit --cve CVE-2015-3246 && searchsploit -m 37706Fetch the ExploitDB PoC locally; review the code before running it.
searchsploit --cve CVE-2015-3246 && searchsploit -m 44633Fetch the ExploitDB PoC locally; review the code before running it.
curl -s https://vulnpedia.com/cve/CVE-2015-3246/poc.jsonMachine-readable PoC index for this CVE (for automation).

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked weekly for the full archive, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Data snapshot:

Affected

Vendors Redhat Opensuse Libuser Project

Products Enterprise Linux Opensuse Libuser

Weakness (CWE)

  • CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
  • CWE-264: Permissions, Privileges, and Access Controls

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References and research data (JSON)

Vendor product assessments

Showing 32 of 126 vendor product statements; 94 omitted. Read the full vendor advisory.

  • libuser-0:0.56.13-8.el6_7.i686 as a component of Red Hat Enterprise Linux Desktop (v. 6) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_7?arch=i686

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Add pam_warn and pam_deny rules to /etc/pam.d/chfn and /etc/pam.d/chsh to prevent non-root users from using this functionality. With these edits, the files should contain: auth sufficient pam_rootok.so auth required pam_warn.so auth required pam_deny.so auth include system-auth account include system-auth password include system-auth session include system-auth After these changes, attempts by unprivileged users to use chfn and chsh (and the respective functionality in the userhelper program) will fail, and will be logged (by default in /var/log/secure).
    Red Hat · CVE-2015-3246 · Updated 2026-08-27T02:00:13+00:00
  • libuser-debuginfo-0:0.56.13-8.el6_7.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 6) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_7?arch=x86_64

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Add pam_warn and pam_deny rules to /etc/pam.d/chfn and /etc/pam.d/chsh to prevent non-root users from using this functionality. With these edits, the files should contain: auth sufficient pam_rootok.so auth required pam_warn.so auth required pam_deny.so auth include system-auth account include system-auth password include system-auth session include system-auth After these changes, attempts by unprivileged users to use chfn and chsh (and the respective functionality in the userhelper program) will fail, and will be logged (by default in /var/log/secure).
    Red Hat · CVE-2015-3246 · Updated 2026-08-27T02:00:13+00:00
  • libuser-debuginfo-0:0.56.13-8.el6_7.x86_64 as a component of Red Hat Enterprise Linux Desktop Optional (v. 6) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_7?arch=x86_64

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Add pam_warn and pam_deny rules to /etc/pam.d/chfn and /etc/pam.d/chsh to prevent non-root users from using this functionality. With these edits, the files should contain: auth sufficient pam_rootok.so auth required pam_warn.so auth required pam_deny.so auth include system-auth account include system-auth password include system-auth session include system-auth After these changes, attempts by unprivileged users to use chfn and chsh (and the respective functionality in the userhelper program) will fail, and will be logged (by default in /var/log/secure).
    Red Hat · CVE-2015-3246 · Updated 2026-08-27T02:00:13+00:00
  • libuser-0:0.56.13-8.el6_7.src as a component of Red Hat Enterprise Linux HPC Node (v. 6) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_7?arch=src

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Add pam_warn and pam_deny rules to /etc/pam.d/chfn and /etc/pam.d/chsh to prevent non-root users from using this functionality. With these edits, the files should contain: auth sufficient pam_rootok.so auth required pam_warn.so auth required pam_deny.so auth include system-auth account include system-auth password include system-auth session include system-auth After these changes, attempts by unprivileged users to use chfn and chsh (and the respective functionality in the userhelper program) will fail, and will be logged (by default in /var/log/secure).
    Red Hat · CVE-2015-3246 · Updated 2026-08-27T02:00:13+00:00
  • libuser-debuginfo-0:0.56.13-8.el6_7.i686 as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_7?arch=i686

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Add pam_warn and pam_deny rules to /etc/pam.d/chfn and /etc/pam.d/chsh to prevent non-root users from using this functionality. With these edits, the files should contain: auth sufficient pam_rootok.so auth required pam_warn.so auth required pam_deny.so auth include system-auth account include system-auth password include system-auth session include system-auth After these changes, attempts by unprivileged users to use chfn and chsh (and the respective functionality in the userhelper program) will fail, and will be logged (by default in /var/log/secure).
    Red Hat · CVE-2015-3246 · Updated 2026-08-27T02:00:13+00:00
  • libuser-0:0.56.13-8.el6_7.i686 as a component of Red Hat Enterprise Linux Server (v. 6) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_7?arch=i686

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Add pam_warn and pam_deny rules to /etc/pam.d/chfn and /etc/pam.d/chsh to prevent non-root users from using this functionality. With these edits, the files should contain: auth sufficient pam_rootok.so auth required pam_warn.so auth required pam_deny.so auth include system-auth account include system-auth password include system-auth session include system-auth After these changes, attempts by unprivileged users to use chfn and chsh (and the respective functionality in the userhelper program) will fail, and will be logged (by default in /var/log/secure).
    Red Hat · CVE-2015-3246 · Updated 2026-08-27T02:00:13+00:00
  • libuser-0:0.56.13-8.el6_7.s390x as a component of Red Hat Enterprise Linux Server (v. 6) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_7?arch=s390x

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Add pam_warn and pam_deny rules to /etc/pam.d/chfn and /etc/pam.d/chsh to prevent non-root users from using this functionality. With these edits, the files should contain: auth sufficient pam_rootok.so auth required pam_warn.so auth required pam_deny.so auth include system-auth account include system-auth password include system-auth session include system-auth After these changes, attempts by unprivileged users to use chfn and chsh (and the respective functionality in the userhelper program) will fail, and will be logged (by default in /var/log/secure).
    Red Hat · CVE-2015-3246 · Updated 2026-08-27T02:00:13+00:00
  • libuser-debuginfo-0:0.56.13-8.el6_7.ppc as a component of Red Hat Enterprise Linux Server (v. 6) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_7?arch=ppc

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Add pam_warn and pam_deny rules to /etc/pam.d/chfn and /etc/pam.d/chsh to prevent non-root users from using this functionality. With these edits, the files should contain: auth sufficient pam_rootok.so auth required pam_warn.so auth required pam_deny.so auth include system-auth account include system-auth password include system-auth session include system-auth After these changes, attempts by unprivileged users to use chfn and chsh (and the respective functionality in the userhelper program) will fail, and will be logged (by default in /var/log/secure).
    Red Hat · CVE-2015-3246 · Updated 2026-08-27T02:00:13+00:00
  • libuser-debuginfo-0:0.56.13-8.el6_7.x86_64 as a component of Red Hat Enterprise Linux Server (v. 6) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_7?arch=x86_64

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Add pam_warn and pam_deny rules to /etc/pam.d/chfn and /etc/pam.d/chsh to prevent non-root users from using this functionality. With these edits, the files should contain: auth sufficient pam_rootok.so auth required pam_warn.so auth required pam_deny.so auth include system-auth account include system-auth password include system-auth session include system-auth After these changes, attempts by unprivileged users to use chfn and chsh (and the respective functionality in the userhelper program) will fail, and will be logged (by default in /var/log/secure).
    Red Hat · CVE-2015-3246 · Updated 2026-08-27T02:00:13+00:00
  • libuser-python-0:0.56.13-8.el6_7.x86_64 as a component of Red Hat Enterprise Linux Server (v. 6) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_7?arch=x86_64

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Add pam_warn and pam_deny rules to /etc/pam.d/chfn and /etc/pam.d/chsh to prevent non-root users from using this functionality. With these edits, the files should contain: auth sufficient pam_rootok.so auth required pam_warn.so auth required pam_deny.so auth include system-auth account include system-auth password include system-auth session include system-auth After these changes, attempts by unprivileged users to use chfn and chsh (and the respective functionality in the userhelper program) will fail, and will be logged (by default in /var/log/secure).
    Red Hat · CVE-2015-3246 · Updated 2026-08-27T02:00:13+00:00
  • libuser-debuginfo-0:0.56.13-8.el6_7.s390 as a component of Red Hat Enterprise Linux Server Optional (v. 6) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_7?arch=s390

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Add pam_warn and pam_deny rules to /etc/pam.d/chfn and /etc/pam.d/chsh to prevent non-root users from using this functionality. With these edits, the files should contain: auth sufficient pam_rootok.so auth required pam_warn.so auth required pam_deny.so auth include system-auth account include system-auth password include system-auth session include system-auth After these changes, attempts by unprivileged users to use chfn and chsh (and the respective functionality in the userhelper program) will fail, and will be logged (by default in /var/log/secure).
    Red Hat · CVE-2015-3246 · Updated 2026-08-27T02:00:13+00:00
  • libuser-devel-0:0.56.13-8.el6_7.ppc as a component of Red Hat Enterprise Linux Server Optional (v. 6) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_7?arch=ppc

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Add pam_warn and pam_deny rules to /etc/pam.d/chfn and /etc/pam.d/chsh to prevent non-root users from using this functionality. With these edits, the files should contain: auth sufficient pam_rootok.so auth required pam_warn.so auth required pam_deny.so auth include system-auth account include system-auth password include system-auth session include system-auth After these changes, attempts by unprivileged users to use chfn and chsh (and the respective functionality in the userhelper program) will fail, and will be logged (by default in /var/log/secure).
    Red Hat · CVE-2015-3246 · Updated 2026-08-27T02:00:13+00:00
  • libuser-0:0.56.13-8.el6_7.i686 as a component of Red Hat Enterprise Linux Workstation (v. 6) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_7?arch=i686

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Add pam_warn and pam_deny rules to /etc/pam.d/chfn and /etc/pam.d/chsh to prevent non-root users from using this functionality. With these edits, the files should contain: auth sufficient pam_rootok.so auth required pam_warn.so auth required pam_deny.so auth include system-auth account include system-auth password include system-auth session include system-auth After these changes, attempts by unprivileged users to use chfn and chsh (and the respective functionality in the userhelper program) will fail, and will be logged (by default in /var/log/secure).
    Red Hat · CVE-2015-3246 · Updated 2026-08-27T02:00:13+00:00
  • libuser-debuginfo-0:0.56.13-8.el6_7.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 6) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_7?arch=x86_64

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Add pam_warn and pam_deny rules to /etc/pam.d/chfn and /etc/pam.d/chsh to prevent non-root users from using this functionality. With these edits, the files should contain: auth sufficient pam_rootok.so auth required pam_warn.so auth required pam_deny.so auth include system-auth account include system-auth password include system-auth session include system-auth After these changes, attempts by unprivileged users to use chfn and chsh (and the respective functionality in the userhelper program) will fail, and will be logged (by default in /var/log/secure).
    Red Hat · CVE-2015-3246 · Updated 2026-08-27T02:00:13+00:00
  • libuser-debuginfo-0:0.56.13-8.el6_7.x86_64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 6) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_7?arch=x86_64

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Add pam_warn and pam_deny rules to /etc/pam.d/chfn and /etc/pam.d/chsh to prevent non-root users from using this functionality. With these edits, the files should contain: auth sufficient pam_rootok.so auth required pam_warn.so auth required pam_deny.so auth include system-auth account include system-auth password include system-auth session include system-auth After these changes, attempts by unprivileged users to use chfn and chsh (and the respective functionality in the userhelper program) will fail, and will be logged (by default in /var/log/secure).
    Red Hat · CVE-2015-3246 · Updated 2026-08-27T02:00:13+00:00
  • libuser-0:0.60-7.el7_1.src as a component of Red Hat Enterprise Linux Client (v. 7) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_1?arch=src

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Add pam_warn and pam_deny rules to /etc/pam.d/chfn and /etc/pam.d/chsh to prevent non-root users from using this functionality. With these edits, the files should contain: auth sufficient pam_rootok.so auth required pam_warn.so auth required pam_deny.so auth include system-auth account include system-auth password include system-auth session include system-auth After these changes, attempts by unprivileged users to use chfn and chsh (and the respective functionality in the userhelper program) will fail, and will be logged (by default in /var/log/secure).
    Red Hat · CVE-2015-3246 · Updated 2026-08-27T02:00:13+00:00
  • libuser-python-0:0.60-7.el7_1.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_1?arch=x86_64

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Add pam_warn and pam_deny rules to /etc/pam.d/chfn and /etc/pam.d/chsh to prevent non-root users from using this functionality. With these edits, the files should contain: auth sufficient pam_rootok.so auth required pam_warn.so auth required pam_deny.so auth include system-auth account include system-auth password include system-auth session include system-auth After these changes, attempts by unprivileged users to use chfn and chsh (and the respective functionality in the userhelper program) will fail, and will be logged (by default in /var/log/secure).
    Red Hat · CVE-2015-3246 · Updated 2026-08-27T02:00:13+00:00
  • libuser-devel-0:0.60-7.el7_1.x86_64 as a component of Red Hat Enterprise Linux Client Optional (v. 7) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_1?arch=x86_64

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Add pam_warn and pam_deny rules to /etc/pam.d/chfn and /etc/pam.d/chsh to prevent non-root users from using this functionality. With these edits, the files should contain: auth sufficient pam_rootok.so auth required pam_warn.so auth required pam_deny.so auth include system-auth account include system-auth password include system-auth session include system-auth After these changes, attempts by unprivileged users to use chfn and chsh (and the respective functionality in the userhelper program) will fail, and will be logged (by default in /var/log/secure).
    Red Hat · CVE-2015-3246 · Updated 2026-08-27T02:00:13+00:00
  • libuser-debuginfo-0:0.60-7.el7_1.i686 as a component of Red Hat Enterprise Linux ComputeNode (v. 7) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_1?arch=i686

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Add pam_warn and pam_deny rules to /etc/pam.d/chfn and /etc/pam.d/chsh to prevent non-root users from using this functionality. With these edits, the files should contain: auth sufficient pam_rootok.so auth required pam_warn.so auth required pam_deny.so auth include system-auth account include system-auth password include system-auth session include system-auth After these changes, attempts by unprivileged users to use chfn and chsh (and the respective functionality in the userhelper program) will fail, and will be logged (by default in /var/log/secure).
    Red Hat · CVE-2015-3246 · Updated 2026-08-27T02:00:13+00:00
  • libuser-devel-0:0.60-7.el7_1.i686 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_1?arch=i686

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Add pam_warn and pam_deny rules to /etc/pam.d/chfn and /etc/pam.d/chsh to prevent non-root users from using this functionality. With these edits, the files should contain: auth sufficient pam_rootok.so auth required pam_warn.so auth required pam_deny.so auth include system-auth account include system-auth password include system-auth session include system-auth After these changes, attempts by unprivileged users to use chfn and chsh (and the respective functionality in the userhelper program) will fail, and will be logged (by default in /var/log/secure).
    Red Hat · CVE-2015-3246 · Updated 2026-08-27T02:00:13+00:00
  • libuser-0:0.60-7.el7_1.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_1?arch=ppc64

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Add pam_warn and pam_deny rules to /etc/pam.d/chfn and /etc/pam.d/chsh to prevent non-root users from using this functionality. With these edits, the files should contain: auth sufficient pam_rootok.so auth required pam_warn.so auth required pam_deny.so auth include system-auth account include system-auth password include system-auth session include system-auth After these changes, attempts by unprivileged users to use chfn and chsh (and the respective functionality in the userhelper program) will fail, and will be logged (by default in /var/log/secure).
    Red Hat · CVE-2015-3246 · Updated 2026-08-27T02:00:13+00:00
  • libuser-0:0.60-7.el7_1.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_1?arch=x86_64

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Add pam_warn and pam_deny rules to /etc/pam.d/chfn and /etc/pam.d/chsh to prevent non-root users from using this functionality. With these edits, the files should contain: auth sufficient pam_rootok.so auth required pam_warn.so auth required pam_deny.so auth include system-auth account include system-auth password include system-auth session include system-auth After these changes, attempts by unprivileged users to use chfn and chsh (and the respective functionality in the userhelper program) will fail, and will be logged (by default in /var/log/secure).
    Red Hat · CVE-2015-3246 · Updated 2026-08-27T02:00:13+00:00
  • libuser-debuginfo-0:0.60-7.el7_1.s390 as a component of Red Hat Enterprise Linux Server (v. 7) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_1?arch=s390

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Add pam_warn and pam_deny rules to /etc/pam.d/chfn and /etc/pam.d/chsh to prevent non-root users from using this functionality. With these edits, the files should contain: auth sufficient pam_rootok.so auth required pam_warn.so auth required pam_deny.so auth include system-auth account include system-auth password include system-auth session include system-auth After these changes, attempts by unprivileged users to use chfn and chsh (and the respective functionality in the userhelper program) will fail, and will be logged (by default in /var/log/secure).
    Red Hat · CVE-2015-3246 · Updated 2026-08-27T02:00:13+00:00
  • libuser-python-0:0.60-7.el7_1.s390x as a component of Red Hat Enterprise Linux Server (v. 7) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_1?arch=s390x

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Add pam_warn and pam_deny rules to /etc/pam.d/chfn and /etc/pam.d/chsh to prevent non-root users from using this functionality. With these edits, the files should contain: auth sufficient pam_rootok.so auth required pam_warn.so auth required pam_deny.so auth include system-auth account include system-auth password include system-auth session include system-auth After these changes, attempts by unprivileged users to use chfn and chsh (and the respective functionality in the userhelper program) will fail, and will be logged (by default in /var/log/secure).
    Red Hat · CVE-2015-3246 · Updated 2026-08-27T02:00:13+00:00
  • libuser-debuginfo-0:0.60-7.ael7b_1.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_1?arch=ppc64le

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Add pam_warn and pam_deny rules to /etc/pam.d/chfn and /etc/pam.d/chsh to prevent non-root users from using this functionality. With these edits, the files should contain: auth sufficient pam_rootok.so auth required pam_warn.so auth required pam_deny.so auth include system-auth account include system-auth password include system-auth session include system-auth After these changes, attempts by unprivileged users to use chfn and chsh (and the respective functionality in the userhelper program) will fail, and will be logged (by default in /var/log/secure).
    Red Hat · CVE-2015-3246 · Updated 2026-08-27T02:00:13+00:00
  • libuser-debuginfo-0:0.60-7.el7_1.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 7) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_1?arch=ppc64

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Add pam_warn and pam_deny rules to /etc/pam.d/chfn and /etc/pam.d/chsh to prevent non-root users from using this functionality. With these edits, the files should contain: auth sufficient pam_rootok.so auth required pam_warn.so auth required pam_deny.so auth include system-auth account include system-auth password include system-auth session include system-auth After these changes, attempts by unprivileged users to use chfn and chsh (and the respective functionality in the userhelper program) will fail, and will be logged (by default in /var/log/secure).
    Red Hat · CVE-2015-3246 · Updated 2026-08-27T02:00:13+00:00
  • libuser-devel-0:0.60-7.el7_1.i686 as a component of Red Hat Enterprise Linux Server Optional (v. 7) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_1?arch=i686

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Add pam_warn and pam_deny rules to /etc/pam.d/chfn and /etc/pam.d/chsh to prevent non-root users from using this functionality. With these edits, the files should contain: auth sufficient pam_rootok.so auth required pam_warn.so auth required pam_deny.so auth include system-auth account include system-auth password include system-auth session include system-auth After these changes, attempts by unprivileged users to use chfn and chsh (and the respective functionality in the userhelper program) will fail, and will be logged (by default in /var/log/secure).
    Red Hat · CVE-2015-3246 · Updated 2026-08-27T02:00:13+00:00
  • libuser-devel-0:0.60-7.el7_1.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_1?arch=x86_64

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Add pam_warn and pam_deny rules to /etc/pam.d/chfn and /etc/pam.d/chsh to prevent non-root users from using this functionality. With these edits, the files should contain: auth sufficient pam_rootok.so auth required pam_warn.so auth required pam_deny.so auth include system-auth account include system-auth password include system-auth session include system-auth After these changes, attempts by unprivileged users to use chfn and chsh (and the respective functionality in the userhelper program) will fail, and will be logged (by default in /var/log/secure).
    Red Hat · CVE-2015-3246 · Updated 2026-08-27T02:00:13+00:00
  • libuser-0:0.60-7.el7_1.src as a component of Red Hat Enterprise Linux Workstation (v. 7) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_1?arch=src

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Add pam_warn and pam_deny rules to /etc/pam.d/chfn and /etc/pam.d/chsh to prevent non-root users from using this functionality. With these edits, the files should contain: auth sufficient pam_rootok.so auth required pam_warn.so auth required pam_deny.so auth include system-auth account include system-auth password include system-auth session include system-auth After these changes, attempts by unprivileged users to use chfn and chsh (and the respective functionality in the userhelper program) will fail, and will be logged (by default in /var/log/secure).
    Red Hat · CVE-2015-3246 · Updated 2026-08-27T02:00:13+00:00
  • libuser-python-0:0.60-7.el7_1.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_1?arch=x86_64

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Add pam_warn and pam_deny rules to /etc/pam.d/chfn and /etc/pam.d/chsh to prevent non-root users from using this functionality. With these edits, the files should contain: auth sufficient pam_rootok.so auth required pam_warn.so auth required pam_deny.so auth include system-auth account include system-auth password include system-auth session include system-auth After these changes, attempts by unprivileged users to use chfn and chsh (and the respective functionality in the userhelper program) will fail, and will be logged (by default in /var/log/secure).
    Red Hat · CVE-2015-3246 · Updated 2026-08-27T02:00:13+00:00
  • libuser-devel-0:0.60-7.el7_1.x86_64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_1?arch=x86_64

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Add pam_warn and pam_deny rules to /etc/pam.d/chfn and /etc/pam.d/chsh to prevent non-root users from using this functionality. With these edits, the files should contain: auth sufficient pam_rootok.so auth required pam_warn.so auth required pam_deny.so auth include system-auth account include system-auth password include system-auth session include system-auth After these changes, attempts by unprivileged users to use chfn and chsh (and the respective functionality in the userhelper program) will fail, and will be logged (by default in /var/log/secure).
    Red Hat · CVE-2015-3246 · Updated 2026-08-27T02:00:13+00:00
  • libuser.src as a component of Red Hat Enterprise Linux 5 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/libuser?arch=src

    • workaround: Add pam_warn and pam_deny rules to /etc/pam.d/chfn and /etc/pam.d/chsh to prevent non-root users from using this functionality. With these edits, the files should contain: auth sufficient pam_rootok.so auth required pam_warn.so auth required pam_deny.so auth include system-auth account include system-auth password include system-auth session include system-auth After these changes, attempts by unprivileged users to use chfn and chsh (and the respective functionality in the userhelper program) will fail, and will be logged (by default in /var/log/secure).
    • no fix planned: Will not fix
    Red Hat · CVE-2015-3246 · Updated 2026-08-27T02:00:13+00:00

Unverified PoC candidates

Catalogue matches for further research. These repositories have not been validated as working exploits.

1 candidate

Additional exploitation reports

Source-specific reports, separate from CISA KEV. Repeated observations from one source are not independent confirmations.

  • VulnCheck KEV · 2026-08-20T00:00:00Z

    Source guidance: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

    Source ransomware assessment: Unknown

    VulnCheck KEV · CVE-2015-3246 · Updated 2026-08-20T00:00:00Z
  • VulnCheck KEV · 2026-08-20T00:00:00ZVulnCheck KEV · CVE-2015-3246
  • VulnCheck KEV · 2026-08-26T00:00:00ZVulnCheck KEV · CVE-2015-3246
    VulnCheck KEV · CVE-2015-3246
  • VulnCheck KEV · 2026-09-08T00:00:00ZVulnCheck KEV · CVE-2015-3246

Known Affected Software Configurations

VendorProductVersion range
RedhatEnterprise Linux5.0
RedhatEnterprise Linux6.0
RedhatEnterprise Linux7.0
OpensuseOpensuse13.2
Libuser ProjectLibuser< 0.56.13-8
Libuser ProjectLibuser≥ 0.60 and < 0.60-7

All CVSS metrics

  • HIGH 7.4 v3.1 · ADP Primary
    CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
  • HIGH 7.4 v3.1 · NVD Secondary
    CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
  • HIGH 7.2 v2.0 · NVD Primary
    AV:L/AC:L/Au:N/C:C/I:C/A:C

References

Exploit-tagged references (not proof of a PoC)

Patches & mitigations

Advisories

Technical & other

Sources: NVD · CVE.org · All sources and attribution · EPSS