CVE-2018-6963
published 2018-05-22CVE-2018-6963: VMware Workstation (14.x before 14.1.2) and Fusion (10.x before 10.1.2) contain multiple denial-of-service vulnerabilities that occur due to NULL pointer…
PriorityP419medium5.5CVSS 3.0
AVLACLPRLUINSUCNINAH
EPSS
0.40%
32.7th percentile
VMware Workstation (14.x before 14.1.2) and Fusion (10.x before 10.1.2) contain multiple denial-of-service vulnerabilities that occur due to NULL pointer dereference issues in the RPC handler. Successful exploitation of these issues may allow an attacker with limited privileges on the guest machine trigger a denial-of-Service of their guest machine.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| vmware | fusion | — | — |
| vmware | fusion | >= 10.0 < 10.1.2 | 10.1.2 |
| vmware | fusion_pro | — | — |
| vmware | vmware_fusion | — | — |
| vmware | vmware_workstation | — | — |
| vmware | workstation | — | — |
| vmware | workstation | >= 14.0 < 14.1.2 | 14.1.2 |
| vmware | workstation_player | — | — |
| vmware | workstation_pro | — | — |
CVSS provenance
nvdv3.05.5MEDIUMCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
nvdv2.02.1LOWAV:L/AC:L/Au:N/C:N/I:N/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VMware
VMware Workstation and Fusion updates address signature bypass and multiple denial-of-service vulnerabilities
vendor_vmware·2018-05-21·CVSS 7.8
CVE-2018-6962 [HIGH] VMware Workstation and Fusion updates address signature bypass and multiple denial-of-service vulnerabilities
VMSA-2018-0013: VMware Workstation and Fusion updates address signature bypass and multiple denial-of-service vulnerabilities
a. Fusion signature bypass vulnerability VMware Fusion contains a signature bypass vulnerability which may lead to a local privilege escalation. VMware would like to thank CodeColorist of AntFinancial LightYear Security Labs for reporting this issue to us. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the identifier CVE-2018-6962 to this issue. Column 5 of the following table lists the action required to remediate the vulnerability in each release, if a solution is available. VMware Product Product Version Running on Severity Replace with/ Apply Patch Mitigation/ Workaround VMware ProductFusion Product Version10.x Running on OS X Sev
GHSA
GHSA-68fh-262x-p9gv: VMware Workstation (14
ghsa_unreviewed·2022-05-14
CVE-2018-6963 [MEDIUM] CWE-476 GHSA-68fh-262x-p9gv: VMware Workstation (14
VMware Workstation (14.x before 14.1.2) and Fusion (10.x before 10.1.2) contain multiple denial-of-service vulnerabilities that occur due to NULL pointer dereference issues in the RPC handler. Successful exploitation of these issues may allow an attacker with limited privileges on the guest machine trigger a denial-of-Service of their guest machine.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2018-05-22
Published