CVE-2016-7085
published 2016-12-29CVE-2016-7085: Untrusted search path vulnerability in the installer in VMware Workstation Pro 12.x before 12.5.0 and VMware Workstation Player 12.x before 12.5.0 on Windows…
PriorityP434high7.8CVSS 3.0
AVLACLPRLUINSUCHIHAH
EPSS
0.42%
35.8th percentile
Untrusted search path vulnerability in the installer in VMware Workstation Pro 12.x before 12.5.0 and VMware Workstation Player 12.x before 12.5.0 on Windows allows local users to gain privileges via a Trojan horse DLL in an unspecified directory.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| vmware | vmware_esxi | — | — |
| vmware | vmware_fusion | — | — |
| vmware | vmware_tools | — | — |
| vmware | vmware_workstation | — | — |
| vmware | workstation_player | — | — |
| vmware | workstation_player | — | — |
| vmware | workstation_player | — | — |
| vmware | workstation_player | — | — |
| vmware | workstation_player | — | — |
| vmware | workstation_pro | — | — |
| vmware | workstation_pro | — | — |
| vmware | workstation_pro | — | — |
| vmware | workstation_pro | — | — |
| vmware | workstation_pro | — | — |
CVSS provenance
nvdv3.07.8HIGHCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-q4gv-cxmr-2mr8: Untrusted search path vulnerability in the installer in VMware Workstation Pro 12
ghsa_unreviewed·2022-05-17
CVE-2016-7085 [HIGH] CWE-426 GHSA-q4gv-cxmr-2mr8: Untrusted search path vulnerability in the installer in VMware Workstation Pro 12
Untrusted search path vulnerability in the installer in VMware Workstation Pro 12.x before 12.5.0 and VMware Workstation Player 12.x before 12.5.0 on Windows allows local users to gain privileges via a Trojan horse DLL in an unspecified directory.
VMware
VMware ESXi, Workstation, Fusion, and Tools updates address multiple security issues
vendor_vmware·2016-09-13·CVSS 7.8
CVE-2016-7079 [HIGH] VMware ESXi, Workstation, Fusion, and Tools updates address multiple security issues
VMSA-2016-0014: VMware ESXi, Workstation, Fusion, and Tools updates address multiple security issues
a. VMware Workstation heap-based buffer overflow vulnerabilities via Cortado ThinPrint VMware Workstation contains vulnerabilities that may allow a Windows-based Virtual Machine (VM) to trigger a heap-based buffer overflow. Exploitation of these issues may lead to arbitrary code execution in VMware Workstation running on Windows. Exploitation is only possible if virtual printing has been enabled in VMware Workstation. This feature is not enabled by default. VMware Knowledge Base article 2146810 documents the procedure for enabling and disabling this feature. VMware would like to thank E0DB6391795D7F629B5077842E649393 working with Trend Micro's Zero Day Initiative for reporting this issue t
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2016-12-29
Published