CVE-2015-3245: Input Validation
Incomplete blacklist vulnerability in the chfn function in libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, allows local users to cause a denial of service (/etc/passwd corruption) via a newline character in the GECOS field.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/libuserto a version that resolves this vulnerability.Fixed in 1:0.56.9.dfsg.1-1.2ubuntu2+esm1
Event History
Frequently Asked Questions
What is the severity of CVE-2015-3245?
CVE-2015-3245 has been classified as a moderate severity vulnerability due to its potential for causing denial of service.
How do I fix CVE-2015-3245?
To fix CVE-2015-3245, you should update libuser to version 0.56.13-8 or 0.60-7 or later.
Which versions of libuser are affected by CVE-2015-3245?
Versions of libuser before 0.56.13-8 and all versions of 0.60 prior to 0.60-7 are affected by CVE-2015-3245.
Can CVE-2015-3245 be exploited remotely?
CVE-2015-3245 cannot be exploited remotely as it requires local user access to be exploited.
What consequences does CVE-2015-3245 have?
CVE-2015-3245 can lead to corruption of the /etc/passwd file, potentially resulting in a denial of service.