CVE-2009-2628

2009-09-0822:30:00

CWE-94

[email protected]

web.nvd.nist.gov

cve-2009-2628

vmnc media codec

vmware

movie decoder

workstation

player

ace

windows

remote code execution

avi file

heap memory corruption

7.5 High

AI Score

Confidence

Low

9.3 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.171 Low

EPSS

Percentile

96.1%

JSON

The VMnc media codec in vmnc.dll in VMware Movie Decoder before 6.5.3 build 185404, VMware Workstation 6.5.x before 6.5.3 build 185404, VMware Player 2.5.x before 2.5.3 build 185404, and VMware ACE 2.5.x before 2.5.3 build 185404 on Windows does not properly handle certain small heights in video content, which might allow remote attackers to execute arbitrary code via a crafted AVI file that triggers heap memory corruption.

CPENameOperatorVersion
vmware:acevmware aceeq2.5.2
vmware:acevmware aceeq2.5.1
vmware:playervmware playereq2.5.1
vmware:playervmware playereq2.5.2
vmware:workstationvmware workstationeq6.5.1
vmware:workstationvmware workstationeq6.5.0
vmware:workstationvmware workstationeq6.5
vmware:playervmware playereq2.5
vmware:movie_decodervmware movie decodereq6.5.3
vmware:workstationvmware workstationeq6.5.2

CPE	Name	Operator	Version
vmware:ace	vmware ace	eq	2.5.2
vmware:ace	vmware ace	eq	2.5.1
vmware:player	vmware player	eq	2.5.1
vmware:player	vmware player	eq	2.5.2
vmware:workstation	vmware workstation	eq	6.5.1
vmware:workstation	vmware workstation	eq	6.5.0
vmware:workstation	vmware workstation	eq	6.5
vmware:player	vmware player	eq	2.5
vmware:movie_decoder	vmware movie decoder	eq	6.5.3
vmware:workstation	vmware workstation	eq	6.5.2