Security bypass in VMware Tools - CVE-2016-5328

Vulnerability identifier: #VU1104

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-5328

CWE-ID: CWE-119

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a local user to bypass security restrictions on the target system.
The weakness is due to access control flaw. By obtaining kernel memory address information, a local attacker can bypass address space layout randomization (ASLR) security protections.
Successful exploitation of the vulnerability results in access to the vulnerable system.

VMware Tools
SUSE Linux Enterprise Micro
gdk-pixbuf-debugsource
typelib-1_0-GdkPixbuf-2_0
libgdk_pixbuf-2_0-0
gdk-pixbuf-query-loaders-debuginfo
gdk-pixbuf-query-loaders
libgdk_pixbuf-2_0-0-debuginfo

Update to version 10.0.1.

gdk-pixbuf-debugsource - update to 2.42.12-150400.5.9.1
typelib-1_0-GdkPixbuf-2_0 - update to 2.42.12-150400.5.9.1
libgdk_pixbuf-2_0-0 - update to 2.42.12-150400.5.9.1
gdk-pixbuf-query-loaders-debuginfo - update to 2.42.12-150400.5.9.1
gdk-pixbuf-query-loaders - update to 2.42.12-150400.5.9.1
libgdk_pixbuf-2_0-0-debuginfo - update to 2.42.12-150400.5.9.1

• http://www.vmware.com/security/advisories/VMSA-2016-0017.html

• Security bypass in VMware, VMware Tools
• SUSE update for gdk-pixbuf