CVE-2017-4950
published 2018-01-11CVE-2017-4950: VMware Workstation and Fusion contain an integer overflow vulnerability in VMware NAT service when IPv6 mode is enabled. This issue may lead to an out-of-bound…
PriorityP428high7CVSS 3.0
AVLACHPRLUINSUCHIHAH
EPSS
0.38%
30.6th percentile
VMware Workstation and Fusion contain an integer overflow vulnerability in VMware NAT service when IPv6 mode is enabled. This issue may lead to an out-of-bound read which can then be used to execute code on the host in conjunction with other issues. Note: IPv6 mode for VMNAT is not enabled by default.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| vmware | fusion | — | — |
| vmware | fusion | — | — |
| vmware | fusion | >= 10.0 < 10.1.1 | 10.1.1 |
| vmware | fusion | >= 8.0 < 8.5.10 | 8.5.10 |
| vmware | fusion_pro | — | — |
| vmware | horizon_client | — | — |
| vmware | vmware_fusion | — | — |
| vmware | vmware_horizon | — | — |
| vmware | vmware_workstation | — | — |
| vmware | workstation | >= 12.0 < 12.5.9 | 12.5.9 |
| vmware | workstation | >= 14.0 < 14.1.1 | 14.1.1 |
| vmware | workstation_player | — | — |
| vmware | workstation_pro | — | — |
| vmware | workstation_pro_player | — | — |
| vmware | workstation_pro_player | — | — |
CVSS provenance
nvdv3.07.0HIGHCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.9MEDIUMAV:L/AC:M/Au:N/C:C/I:C/A:C
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VMware
VMware Workstation, and Fusion updates resolve use-after-free and integer-overflow vulnerabilities
vendor_vmware·2018-01-10·CVSS 7.0
CVE-2017-4949 [HIGH] VMware Workstation, and Fusion updates resolve use-after-free and integer-overflow vulnerabilities
VMSA-2018-0005: VMware Workstation, and Fusion updates resolve use-after-free and integer-overflow vulnerabilities
VMware Workstation, and Fusion updates resolve use-after-free and integer-overflow vulnerabilities 2. Relevant Products VMware Workstation Pro / Player (Workstation) VMware Fusion Pro / Fusion (Fusion) 3. Problem Description a. Use-after-free vulnerability in VMware NAT service VMware Workstation and Fusion contain a use-after-free vulnerability in VMware NAT service when IPv6 mode is enabled. This issue may allow a guest to execute code on the host. Note: IPv6 mode for VMNAT is not enabled by default. VMware would like to thank WenQunWang of Tencent's Xuanwu LAB for reporting this issue to us. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the
VMware
VMware Workstation, Player and Horizon View Client for Windows updates address a host privilege escalation vulnerability
vendor_vmware·2015-07-09·CVSS 7.2
CVE-2015-3650 [HIGH] VMware Workstation, Player and Horizon View Client for Windows updates address a host privilege escalation vulnerability
VMSA-2015-0005: VMware Workstation, Player and Horizon View Client for Windows updates address a host privilege escalation vulnerability
a. VMware Workstation, Player and Horizon View Client for Windows host privilege escalation vulnerability. VMware Workstation, Player and Horizon View Client for Windows do not set a discretionary access control list (DACL) for one of their processes. This may allow a local attacker to elevate their privileges and execute code in the security context of the affected process. VMware would like to thank Kyriakos Economou of Nettitude for reporting this issue to us. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the identifier CVE-2015-3650 to this issue. Column 4 of the following table lists the action required to remediate t
GHSA
GHSA-72cc-6qc5-x46j: VMware Workstation and Fusion contain an integer overflow vulnerability in VMware NAT service when IPv6 mode is enabled
ghsa_unreviewed·2022-05-14
CVE-2017-4950 [HIGH] CWE-190 GHSA-72cc-6qc5-x46j: VMware Workstation and Fusion contain an integer overflow vulnerability in VMware NAT service when IPv6 mode is enabled
VMware Workstation and Fusion contain an integer overflow vulnerability in VMware NAT service when IPv6 mode is enabled. This issue may lead to an out-of-bound read which can then be used to execute code on the host in conjunction with other issues. Note: IPv6 mode for VMNAT is not enabled by default.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2018-01-11
Published