Improper input validation in Red Hat Libuser
CVE-2015-3245
Incomplete blacklist vulnerability in the chfn function in libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, allows local users to cause a denial of service (/etc/passwd corruption) via a newline character in the GECOS field.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
Published · last modified .
CVSS v2 metric
CVSS v2 base score 2.1 (Low). Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.053 (92.4th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 92nd percentile — 92.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.053 · newest: 0.053 · change: +0.001
Affected products
- Red Hat Libuser — versions 0.60-1, 0.60-2, 0.60-3
Weakness classification (CWE)
Public proof-of-concept exploits
References
- lists.fedoraproject.org/pipermail/package-announce/2015-July/162947.html (vendor-advisory)
- www.exploit-db.com/exploits/44633/ (exploit)
- access.redhat.com/articles/1537873
- rhn.redhat.com/errata/RHSA-2015-1482.html (vendor-advisory)
- lists.fedoraproject.org/pipermail/package-announce/2015-August/163044.html (vendor-advisory)
- www.qualys.com/2015/07/23/cve-2015-3245-cve-2015-3246/cve-2015-3245-cve-2015-32… (Exploit)
- www.securitytracker.com/id/1033040 (vdb-entry)
- www.securityfocus.com/bid/76021 (vdb-entry)
- rhn.redhat.com/errata/RHSA-2015-1483.html (vendor-advisory)
Frequently asked questions
- What is CVE-2015-3245?
- CVE-2015-3245 is a vulnerability in Red Hat Libuser, classified under Improper Input Validation. Published 2015-08-11.
- Is CVE-2015-3245 known to be exploited?
- 6 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.