KLA11177 Multiple vulnerabilities in VMware products

Multiple serious vulnerabilities have been found in VMware Workstation and VMware Fusion. Malicious users can exploit these vulnerabilities to execute arbitrary code.

Below is a complete list of vulnerabilities:

1. A use-after-free vulnerability in VMware NAT service when IPv6 mode is enabled can be exploited remotely to execute arbitrary code;
2. An integer overflow vulnerability in VMware NAT service when IPv6 mode is enabled can be exploited remotely to execute arbitrary code;

Original advisories

VMSA-2018-0005

Related products

VMware-Workstation

VMware-Fusion

CVE list

CVE-2017-4949 high

CVE-2017-4950 high

Solution

Update to latest versionDownload VMware Fusion

Download VMware Workstation Pro

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

Affected Products

• Workstation 14.x earlier than 14.1.1Workstation 12.x earlier than 12.5.9Fusion 10.x earlier than 10.1.1Fusion 8.x earlier than 8.5.10