Description
Incomplete blacklist vulnerability in the chfn function in libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, allows local users to cause a denial of service (/etc/passwd corruption) via a newline character in the GECOS field.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libuser | 1:0.62~dfsg-0.1 | — |
| Debian 13 | libuser | 1:0.62~dfsg-0.1 | — |
| Debian 12 | libuser | 1:0.62~dfsg-0.1 | — |
| Debian 7 | libuser | 1:0.56.9.dfsg.1-1.2+deb7u1 | DLA-468-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 25.10 | libuser | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | libuser | 1:0.60~dfsg-1.2ubuntu0.1~esm1 | USN-8987-1 |
| Ubuntu Pro 14.04 LTS | libuser | 1:0.56.9.dfsg.1-1.2ubuntu2+esm1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | libuser +2 | 0.60-7.ael7b_1 | RHSA-2015:1483 |
| RHEL 6 | libuser +2 | 0.56.13-8.el6_7 | RHSA-2015:1482 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | libuser +2 | 0.60-7.el7_1 | ELSA-2015-1483 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
Libuser roothelper Privilege Escalation
exploit/linux/local/libuser_roothelper_priv_esc
Exploit-DB 2
- Libuser - 'roothelper' Local Privilege Escalation (Metasploit) EDB-44633 · local · May 16, 2018 · verified
- Libuser Library - Multiple Vulnerabilities EDB-37706 · dos · Jul 27, 2015 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 5
- USN-8987-1 libuser vulnerabilities Ubuntu Security Notices (USN) · Nov 4, 2026
- RHSA-2015:1483 Red Hat Security Advisory: libuser security update Red Hat Security Advisories (RHSA) · Aug 27, 2026
- RHSA-2015:1482 Red Hat Security Advisory: libuser security update Red Hat Security Advisories (RHSA) · Aug 27, 2026
- DLA-468-1 libuser - security update Debian Security (DSA / DLA) · Mar 9, 2026
- ELSA-2015-1483 Important: libuser security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jul 23, 2015
References
- FEDORA-2015-12301 vendor-advisory
- 44633 exploit
- https://access.redhat.com/articles/1537873
- RHSA-2015:1482 vendor-advisory
- FEDORA-2015-12064 vendor-advisory
- https://www.qualys.com/2015/07/23/cve-2015-3245-cve-2015-3246/cve-2015-3245-cve-2015-3246.txt
- 1033040 vdb-entry
- 76021 vdb-entry
- RHSA-2015:1483 vendor-advisory