Vulnerability Details : CVE-2016-5328
VMware Tools 9.x and 10.x before 10.1.0 on OS X, when System Integrity Protection (SIP) is enabled, allows local users to determine kernel memory addresses and bypass the kASLR protection mechanism via unspecified vectors.
Vulnerability category: Information leak
Products affected by CVE-2016-5328
- cpe:2.3:a:vmware:tools:*:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:tools:10.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:tools:10.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:tools:10.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:tools:9.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:tools:9.0.16:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:tools:9.0.17:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:tools:9.10.0:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:tools:9.10.1:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:tools:9.0.11:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:tools:9.0.12:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:tools:9.4.10:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:tools:9.4.11:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:tools:9.0.13:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:tools:9.0.15:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:tools:9.4.12:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:tools:9.4.15:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:tools:9.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:tools:9.0.10:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:tools:9.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:tools:9.4.5:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:tools:9.10.5:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:tools:9.0.0:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2016-5328
0.04%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 6 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2016-5328
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
2.1
|
LOW | AV:L/AC:L/Au:N/C:P/I:N/A:N |
3.9
|
2.9
|
NIST | |
|
5.5
|
MEDIUM | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
1.8
|
3.6
|
NIST |
CWE ids for CVE-2016-5328
-
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.Assigned by: nvd@nist.gov (Primary)
-
Assigned by: nvd@nist.gov (Primary)
References for CVE-2016-5328
-
http://www.securitytracker.com/id/1037102
VMware Tools on Mac OS X Virtual Machines Information Disclosure Bug Lets Local Users Bypass Security Restrictions on the Target System - SecurityTracker
-
http://www.securityfocus.com/bid/93886
VMware Tools CVE-2016-5328 Local Information Disclosure VulnerabilityThird Party Advisory;VDB Entry
-
http://www.vmware.com/security/advisories/VMSA-2016-0017.html
VMSA-2016-0017Vendor Advisory
Jump to