CVE-2017-4913
published 2017-06-08CVE-2017-4913: VMware Workstation (12.x prior to 12.5.3) and Horizon View Client (4.x prior to 4.4.0) contain an integer-overflow vulnerability in the True Type Font parser…
PriorityP336high7.8CVSS 3.0
AVLACHPRLUINSCCHIHAH
EPSS
0.39%
32.8th percentile
VMware Workstation (12.x prior to 12.5.3) and Horizon View Client (4.x prior to 4.4.0) contain an integer-overflow vulnerability in the True Type Font parser in the TPView.dll. On Workstation, this may allow a guest to execute code or perform a Denial of Service on the Windows OS that runs Workstation. In the case of a Horizon View Client, this may allow a View desktop to execute code or perform a Denial of Service on the Windows OS that runs the Horizon View Client. Exploitation is only possible if virtual printing has been enabled. This feature is not enabled by default on Workstation but it is enabled by default on Horizon View.
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| vmware | horizon_client | — | — |
| vmware | horizon_view | — | — |
| vmware | horizon_view | — | — |
| vmware | horizon_view | — | — |
| vmware | horizon_view | — | — |
| vmware | horizon_view_client_for_windows | — | — |
| vmware | vmware_horizon | — | — |
| vmware | vmware_workstation | — | — |
| vmware | workstation | — | — |
| vmware | workstation | — | — |
| vmware | workstation | — | — |
| vmware | workstation | — | — |
| vmware | workstation | — | — |
| vmware | workstation | — | — |
| vmware | workstation | — | — |
| vmware | workstation | — | — |
| vmware | workstation_player | — | — |
| vmware | workstation_pro | — | — |
CVSS provenance
nvdv3.07.8HIGHCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
nvdv2.06.9MEDIUMAV:L/AC:M/Au:N/C:C/I:C/A:C
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-8fxx-v4g8-vr7h: VMware Workstation (12
ghsa_unreviewed·2022-05-17
CVE-2017-4913 [HIGH] CWE-190 GHSA-8fxx-v4g8-vr7h: VMware Workstation (12
VMware Workstation (12.x prior to 12.5.3) and Horizon View Client (4.x prior to 4.4.0) contain an integer-overflow vulnerability in the True Type Font parser in the TPView.dll. On Workstation, this may allow a guest to execute code or perform a Denial of Service on the Windows OS that runs Workstation. In the case of a Horizon View Client, this may allow a View desktop to execute code or perform a Denial of Service on the Windows OS that runs the Horizon View Client. Exploitation is only possible if virtual printing has been enabled. This feature is not enabled by default on Workstation but it is enabled by default on Horizon View.
VMware
VMware Unified Access Gateway, Horizon View and Workstation updates resolve multiple security vulnerabilities
vendor_vmware·2017-04-18·CVSS 9.8
CVE-2017-4907 [CRITICAL] VMware Unified Access Gateway, Horizon View and Workstation updates resolve multiple security vulnerabilities
VMSA-2017-0008: VMware Unified Access Gateway, Horizon View and Workstation updates resolve multiple security vulnerabilities
a. Unified Access Gateway and Horizon View heap buffer-overflow vulnerability VMware Unified Access Gateway and Horizon View contain a heap buffer-overflow vulnerability which may allow a remote attacker to execute code on the security gateway. VMware would like to thank Claudio Moletta (redr2e) for reporting this issue to us. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the identifier CVE-2017-4907 to this issue. Column 5 of the following table lists the action required to remediate the vulnerability in each release, if a solution is available. VMware Product Product Version Running on Severity Replace with/ Apply Patch Mitigation/
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2017-06-08
Published