7.8high
CVE-2016-6592
A vulnerability was found in Symantec Norton Download Manager versions prior to 5.6.
Published 6 y ago · modified 4 mo ago · JSON
CVSS
7.8
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
1.0%
percentile 62%
Public exploits
0
none known
Summary
A vulnerability was found in Symantec Norton Download Manager versions prior to 5.6. A remote user can create a specially crafted DLL file that, when placed on the target user's system, will cause the Norton Download Manager component to load the remote user's DLL instead of the intended DLL and execute arbitrary code when the Norton Download Manager component is run by the target user.
Exploit prediction (EPSS)
0.96% probability of exploitation in the next 30 days, higher than 62% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.1 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 4.6 | AV:L/AC:L/Au:N/C:P/I:P/A:P |
Affected products
- Symantec Norton Download Manager
Classification
- Weakness
- CWE-427 Uncontrolled Search Path Element
References
- securityfocus.com /bid/94695 · x_refsource_MISC, x_transferred
- securityfocus.com /bid/95444 · x_refsource_MISC, x_transferred
- securitytracker.com /id/1037622 · x_refsource_MISC, x_transferred
- securitytracker.com /id/1037623 · x_refsource_MISC, x_transferred
- securitytracker.com /id/1037624 · x_refsource_MISC, x_transferred
- support.symantec.com /us/en/article.SYMSA1394.html · x_refsource_CONFIRM, x_transferred
Sources
- CVE List: CVE-2016-6592
- NVD: CVE-2016-6592
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.