High · published August 11, 2015
CVSS calls it high at 7.4. It is confirmed in active exploitation. It sits in the 95.0th percentile for exploit probability.
libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /etc/passwd, which allows local users to cause a denial of service (inconsistent file state) by causing an error during the modification. NOTE: this issue can be combined with CVE-2015-3245 to gain privileges.
| Product | Versions | Fixed in |
|---|---|---|
| redhat/enterprise_linux | all versions | — |
| redhat/enterprise_linux | all versions | — |
| redhat/enterprise_linux | all versions | — |
| opensuse/opensuse | all versions | — |
| libuser_project/libuser | < 0.56.13-8 | 0.56.13-8 |
| libuser_project/libuser | ≥ 0.60, < 0.60-7 | 0.60-7 |