7.8high
CVE-2016-5311
A Privilege Escalation vulnerability exists in Symantec Norton Antivirus, Norton AntiVirus with Backup, Norton Security, Norton Security wi…
Published 6 y ago · modified 4 mo ago · JSON
CVSS
7.8
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
0.7%
percentile 54%
Public exploits
0
none known
Summary
A Privilege Escalation vulnerability exists in Symantec Norton Antivirus, Norton AntiVirus with Backup, Norton Security, Norton Security with Backup, Norton Internet Security, Norton 360, Endpoint Protection Small Business Edition Cloud, and Endpoint Protection Cloud Client due to a DLL-preloading without path restrictions, which could let a local malicious user obtain system privileges.
Exploit prediction (EPSS)
0.71% probability of exploitation in the next 30 days, higher than 54% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.1 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.9 | AV:L/AC:M/Au:N/C:C/I:C/A:C |
Affected products
- Symantec Norton Antivirus, Norton AntiVirus with Backup, Norton Security, Norton Security with Backup, Norton Internet Security, Norton 360
- Symantec Endpoint Protection Small Business Edition Cloud, and Endpoint Protection Cloud Client
Classification
- Weakness
- CWE-427 Uncontrolled Search Path Element
References
- securityfocus.com /bid/94295 · x_refsource_MISC, x_transferred
- securitytracker.com /id/1037323 · x_refsource_MISC, x_transferred
- securitytracker.com /id/1037324 · x_refsource_MISC, x_transferred
- securitytracker.com /id/1037325 · x_refsource_MISC, x_transferred
- symantec.com /security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory · x_refsource_CONFIRM, x_transferred
Sources
- CVE List: CVE-2016-5311
- NVD: CVE-2016-5311
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.