CVE-2015-3245
Redhat Libuser: improper input validation can lead to denial of service
- Risk score
- 41/100
- CVSS
- 2.1 v2.0
- Exploit chance (30 days)
- 5.4%
- Published
- 11 Aug 2015
Open in the live forecast Today's forecast
What to know
- What it is
- Incomplete blacklist vulnerability in the chfn function in libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, allows local users to cause a denial of service (/etc/passwd corruption) via a newline character in the GECOS field.
- Affected
- Redhat Libuser before 0.56.13, 0.60
- Fix
- Upgrade Redhat Libuser to 0.56.13 or 0.60 (whichever matches your release line), or later.
- Exploitation
- Public proof of concept
Why it is Yellow
- CVSS 2.1 low
- Exploitation likely: EPSS 5.4% (top 7%)
- Public exploit or proof of concept referenced
- Named in a government or vendor bulletin
Government and vendor bulletins
References
- https://ubuntu.com/security/notices/USN-8987-1
- http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163044.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-July/162947.html
- http://rhn.redhat.com/errata/RHSA-2015-1482.html
- http://rhn.redhat.com/errata/RHSA-2015-1483.html
- http://www.securityfocus.com/bid/76021
- http://www.securitytracker.com/id/1033040
- https://access.redhat.com/articles/1537873
- https://www.exploit-db.com/exploits/44633/
- https://www.qualys.com/2015/07/23/cve-2015-3245-cve-2015-3246/cve-2015-3245-cve-2015-3246.txt
Original description
Incomplete blacklist vulnerability in the chfn function in libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, allows local users to cause a denial of service (/etc/passwd corruption) via a newline character in the GECOS field.
Last activity 3 Nov 2026. Patch Forecast updates every hour.