CVE-2016-2077
published 2016-05-18CVE-2016-2077: VMware Workstation 11.x before 11.1.3 and VMware Player 7.x before 7.1.3 on Windows incorrectly access an executable file, which allows host OS users to gain…
PriorityP350critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EPSS
1.83%
76.4th percentile
VMware Workstation 11.x before 11.1.3 and VMware Player 7.x before 7.1.3 on Windows incorrectly access an executable file, which allows host OS users to gain host OS privileges via unspecified vectors.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| vmware | player | — | — |
| vmware | player | — | — |
| vmware | player | — | — |
| vmware | player | — | — |
| vmware | vcenter_server | — | — |
| vmware | vmware_workstation | — | — |
| vmware | vsphere | — | — |
| vmware | workstation | — | — |
| vmware | workstation | — | — |
| vmware | workstation | — | — |
| vmware | workstation | — | — |
CVSS provenance
nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VMware
VMware product updates address critical and important security issues.
vendor_vmware·2016-05-17·CVSS 9.8
CVE-2016-2077 [CRITICAL] VMware product updates address critical and important security issues.
VMSA-2016-0005: VMware product updates address critical and important security issues.
a. Critical JMX issue when deserializing authentication credentials The RMI server of Oracle JRE JMX deserializes any class when deserializing authentication credentials. This may allow a remote, unauthenticated attacker to cause deserialization flaws and execute their commands. Workarounds CVE-2016-3427 vCenter Server Apply the steps of VMware Knowledge Base article 2145343 to vCenterServer 6.0 on Windows. See the table below for the specific vCenterServer 6.0 versions on Windows this applies to. vCloud Director No workaround identified vSphere Replication No workaround identified vRealize Operations Manager (non-appliance) The non-appliance version of vRealize Operations Manager (vROps), which can be
GHSA
GHSA-9c56-6w4h-cgc4: VMware Workstation 11
ghsa_unreviewed·2022-05-17
CVE-2016-2077 [CRITICAL] GHSA-9c56-6w4h-cgc4: VMware Workstation 11
VMware Workstation 11.x before 11.1.3 and VMware Player 7.x before 7.1.3 on Windows incorrectly access an executable file, which allows host OS users to gain host OS privileges via unspecified vectors.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2016-05-18
Published