Lucene search

VmwareCVE-2017-4936

HistoryNov 17, 2017 - 2:29 p.m.

CVE-2017-4936

2017-11-1714:29:00

CWE-125

vmware

web.nvd.nist.gov

cve-2017-4936

vmware

workstation

horizon view client

windows

jpeg2000

parser

vulnerability

out-of-bounds read

nvd

CVSS2

6.9

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:M/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

AI Score

8.2

Confidence

High

EPSS

0.001

Percentile

30.7%

JSON

VMware Workstation (12.x before 12.5.8) and Horizon View Client for Windows (4.x before 4.6.1) contain an out-of-bounds read vulnerability in JPEG2000 parser in the TPView.dll. On Workstation, this may allow a guest to execute code or perform a Denial of Service on the Windows OS that runs Workstation. In the case of a Horizon View Client, this may allow a View desktop to execute code or perform a Denial of Service on the Windows OS that runs the Horizon View Client.

Affected configurations

Nvd

Node

vmwareworkstationMatch12.0.0

vmwareworkstationMatch12.0.1

vmwareworkstationMatch12.1

vmwareworkstationMatch12.1.1

vmwareworkstationMatch12.5

vmwareworkstationMatch12.5.1

vmwareworkstationMatch12.5.2

vmwareworkstationMatch12.5.3

vmwareworkstationMatch12.5.4

vmwareworkstationMatch12.5.5

vmwareworkstationMatch12.5.6

vmwareworkstationMatch12.5.7

Node

vmwarehorizon_viewMatch4.0.0windows

vmwarehorizon_viewMatch4.0.1windows

vmwarehorizon_viewMatch4.1windows

vmwarehorizon_viewMatch4.2windows

vmwarehorizon_viewMatch4.3windows

vmwarehorizon_viewMatch4.4windows

vmwarehorizon_viewMatch4.5windows

vmwarehorizon_viewMatch4.6windows

VendorProductVersionCPE
vmwareworkstation12.0.0cpe:2.3:a:vmware:workstation:12.0.0:*:*:*:*:*:*:*
vmwareworkstation12.0.1cpe:2.3:a:vmware:workstation:12.0.1:*:*:*:*:*:*:*
vmwareworkstation12.1cpe:2.3:a:vmware:workstation:12.1:*:*:*:*:*:*:*
vmwareworkstation12.1.1cpe:2.3:a:vmware:workstation:12.1.1:*:*:*:*:*:*:*
vmwareworkstation12.5cpe:2.3:a:vmware:workstation:12.5:*:*:*:*:*:*:*
vmwareworkstation12.5.1cpe:2.3:a:vmware:workstation:12.5.1:*:*:*:*:*:*:*
vmwareworkstation12.5.2cpe:2.3:a:vmware:workstation:12.5.2:*:*:*:*:*:*:*
vmwareworkstation12.5.3cpe:2.3:a:vmware:workstation:12.5.3:*:*:*:*:*:*:*
vmwareworkstation12.5.4cpe:2.3:a:vmware:workstation:12.5.4:*:*:*:*:*:*:*
vmwareworkstation12.5.5cpe:2.3:a:vmware:workstation:12.5.5:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
vmware	workstation	12.0.0	cpe:2.3:a:vmware:workstation:12.0.0:::::::*
vmware	workstation	12.0.1	cpe:2.3:a:vmware:workstation:12.0.1:::::::*
vmware	workstation	12.1	cpe:2.3:a:vmware:workstation:12.1:::::::*
vmware	workstation	12.1.1	cpe:2.3:a:vmware:workstation:12.1.1:::::::*
vmware	workstation	12.5	cpe:2.3:a:vmware:workstation:12.5:::::::*
vmware	workstation	12.5.1	cpe:2.3:a:vmware:workstation:12.5.1:::::::*
vmware	workstation	12.5.2	cpe:2.3:a:vmware:workstation:12.5.2:::::::*
vmware	workstation	12.5.3	cpe:2.3:a:vmware:workstation:12.5.3:::::::*
vmware	workstation	12.5.4	cpe:2.3:a:vmware:workstation:12.5.4:::::::*
vmware	workstation	12.5.5	cpe:2.3:a:vmware:workstation:12.5.5:::::::*

Rows per page:

1-10 of 201

CNA Affected

[
  {
    "product": "Workstation",
    "vendor": "VMware",
    "versions": [
      {
        "status": "affected",
        "version": "12.x before 12.5.8"
      }
    ]
  },
  {
    "product": "Horizon View Client for Windows",
    "vendor": "VMware",
    "versions": [
      {
        "status": "affected",
        "version": "4.x before 4.6.1"
      }
    ]
  }
]

References

www.securityfocus.com/bid/101892

www.securitytracker.com/id/1039835

www.securitytracker.com/id/1039836

www.vmware.com/security/advisories/VMSA-2017-0018.html

CVSS2

6.9

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:M/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

AI Score

8.2

Confidence

High

EPSS

0.001

Percentile

30.7%

JSON

Related for CVE-2017-4936