CVE-2009-2628
published 2009-09-08CVE-2009-2628: The VMnc media codec in vmnc.dll in VMware Movie Decoder before 6.5.3 build 185404, VMware Workstation 6.5.x before 6.5.3 build 185404, VMware Player 2.5.x…
PriorityP348critical9.3CVSS 2.0
AVNACMAuNCCICAC
EPSS
5.57%
91.9th percentile
The VMnc media codec in vmnc.dll in VMware Movie Decoder before 6.5.3 build 185404, VMware Workstation 6.5.x before 6.5.3 build 185404, VMware Player 2.5.x before 2.5.3 build 185404, and VMware ACE 2.5.x before 2.5.3 build 185404 on Windows does not properly handle certain small heights in video content, which might allow remote attackers to execute arbitrary code via a crafted AVI file that triggers heap memory corruption.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| vmware | ace | — | — |
| vmware | ace | — | — |
| vmware | ace | — | — |
| vmware | esxi | — | — |
| vmware | movie_decoder | — | — |
| vmware | player | — | — |
| vmware | player | — | — |
| vmware | player | — | — |
| vmware | vmware_workstation | — | — |
| vmware | workstation | — | — |
| vmware | workstation | — | — |
| vmware | workstation | — | — |
| vmware | workstation | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VMware
VMware Movie Decoder, VMware Workstation, VMware Player, and VMware ACE resolve security issues.
vendor_vmware·2009-09-04·CVSS 9.3
CVE-2009-0199 [CRITICAL] VMware Movie Decoder, VMware Workstation, VMware Player, and VMware ACE resolve security issues.
VMSA-2009-0012: VMware Movie Decoder, VMware Workstation, VMware Player, and VMware ACE resolve security issues.
Several security issues resolved with the latest VMnc codec. The VMware movie decoder contains the VMnc media codec that is required to play back movies recorded with VMware Workstation, VMware Player and VMware ACE, in any compatible media player. The movie decoder is installed as part of VMware Workstation, VMware Player and VMware ACE, or can be downloaded as a stand alone package. Several vulnerabilities in the VMnc codec can be exploited to cause heap-based buffer overflows via specially crafted video files containing incorrect framebuffer parameters. For an attack to be successful the user must be tricked into visiting a malicious web page or opening a malicious video fil
GHSA
GHSA-678r-9fw4-2w76: The VMnc media codec in vmnc
ghsa_unreviewed·2022-05-02
CVE-2009-2628 [HIGH] CWE-94 GHSA-678r-9fw4-2w76: The VMnc media codec in vmnc
The VMnc media codec in vmnc.dll in VMware Movie Decoder before 6.5.3 build 185404, VMware Workstation 6.5.x before 6.5.3 build 185404, VMware Player 2.5.x before 2.5.3 build 185404, and VMware ACE 2.5.x before 2.5.3 build 185404 on Windows does not properly handle certain small heights in video content, which might allow remote attackers to execute arbitrary code via a crafted AVI file that triggers heap memory corruption.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://lists.vmware.com/pipermail/security-announce/2009/000065.htmlhttp://secunia.com/advisories/34938http://www.kb.cert.org/vuls/id/444513http://www.securityfocus.com/archive/1/506286/100/0/threadedhttp://www.securityfocus.com/bid/36290http://www.vmware.com/security/advisories/VMSA-2009-0012.htmlhttp://www.vupen.com/english/advisories/2009/2553http://lists.vmware.com/pipermail/security-announce/2009/000065.htmlhttp://secunia.com/advisories/34938http://www.kb.cert.org/vuls/id/444513http://www.securityfocus.com/archive/1/506286/100/0/threadedhttp://www.securityfocus.com/bid/36290http://www.vmware.com/security/advisories/VMSA-2009-0012.htmlhttp://www.vupen.com/english/advisories/2009/2553
2009-09-08
Published