VMSA-2017-0021 : VMware ESXi, vCenter Server Appliance, Workstation and Fusion updates address multiple security vulnerabilities

a. ESXi, Workstation, and Fusion stack overflow via authenticated VNC session VMware ESXi, Workstation, and Fusion contain a vulnerability that could allow an authenticated VNC session to cause a stack overflow via a specific set of VNC packets. Successful exploitation of this issue could result ...

Remote code execution

VMware ESXi 6.0 before ESXi600-201711101-SG, 5.5 ESXi550-201709101-SG, Workstation 12.x before 12.5.8, and Fusion 8.x before 8.5.9 contain a vulnerability that could allow an authenticated VNC session to cause a stack overflow via a specific set of VNC packets. Successful exploitation of this iss...

Cross site scripting

The ESXi Host Client in VMware ESXi 6.5 before ESXi650-201712103-SG, 5.5 before ESXi600-201711103-SG and 5.5 before ESXi550-201709102-SG contains a vulnerability that may allow for stored cross-site scripting XSS. An attacker can exploit this vulnerability by injecting Javascript, which might get...

CVE-2017-4940

The ESXi Host Client in VMware ESXi 6.5 before ESXi650-201712103-SG, 5.5 before ESXi600-201711103-SG and 5.5 before ESXi550-201709102-SG contains a vulnerability that may allow for stored cross-site scripting XSS. An attacker can exploit this vulnerability by injecting Javascript, which might get...

CVE-2017-4943

VMware vCenter Server Appliance vCSA 6.5 before 6.5 U1d contains a local privilege escalation vulnerability via the 'showlog' plugin. Successful exploitation of this issue could result in a low privileged user gaining root level privileges over the appliance base OS...

CVE-2017-4933

VMware ESXi 6.5 before ESXi650-201710401-BG, Workstation 12.x before 12.5.8, and Fusion 8.x before 8.5.9 contain a vulnerability that could allow an authenticated VNC session to cause a heap overflow via a specific set of VNC packets resulting in heap corruption. Successful exploitation of this...

Remote code execution

VMware ESXi 6.5 before ESXi650-201710401-BG, Workstation 12.x before 12.5.8, and Fusion 8.x before 8.5.9 contain a vulnerability that could allow an authenticated VNC session to cause a heap overflow via a specific set of VNC packets resulting in heap corruption. Successful exploitation of this...

Privilege escalation

VMware vCenter Server Appliance vCSA 6.5 before 6.5 U1d contains a local privilege escalation vulnerability via the 'showlog' plugin. Successful exploitation of this issue could result in a low privileged user gaining root level privileges over the appliance base OS...

CVE-2017-4933

VMware ESXi 6.5 before ESXi650-201710401-BG, Workstation 12.x before 12.5.8, and Fusion 8.x before 8.5.9 contain a vulnerability that could allow an authenticated VNC session to cause a heap overflow via a specific set of VNC packets resulting in heap corruption. Successful exploitation of this...

CVE-2017-4941

VMware ESXi 6.0 before ESXi600-201711101-SG, 5.5 ESXi550-201709101-SG, Workstation 12.x before 12.5.8, and Fusion 8.x before 8.5.9 contain a vulnerability that could allow an authenticated VNC session to cause a stack overflow via a specific set of VNC packets. Successful exploitation of this iss...

CVE-2017-4933

VMware ESXi 6.5 before ESXi650-201710401-BG, Workstation 12.x before 12.5.8, and Fusion 8.x before 8.5.9 contain a vulnerability that could allow an authenticated VNC session to cause a heap overflow via a specific set of VNC packets resulting in heap corruption. Successful exploitation of this...

CVE-2017-4933

Summary: CVE-2017-4933 affects VMware ESXi (6.5 prior to ESXi650-201710401-BG), VMware Workstation (12.x prior to 12.5.8), and VMware Fusion (8.x prior to 8.5.9). It describes a heap overflow in the VNC component that can be triggered by a specific set of VNC packets in an authenticated VNC sessi...

CVE-2017-4943

CVE-2017-4943 affects VMware vCenter Server Appliance (vCSA) 6.5 prior to 6.5 Update 1d (U1d). A local privilege-escalation via the 'showlog' plugin could allow a low-privileged user to gain root privileges on the appliance base OS. Public details in VMware’s VMSA-2017-0021 describe this issue an...

CVE-2017-4940

The CVE-2017-4940 issue affects the ESXi Host Client component of VMware ESXi. It is a stored cross-site scripting (XSS) vulnerability allowing an attacker to inject Javascript that may execute when other users access the Host Client. Affected product versions; ESXi 6.5 before ESXi650-201712103-S...

CVE-2017-4941

CVE-2017-4941 affects VMware products: ESXi 6.0 (pre-ESXi600-201711101-SG) and ESXi 5.5 (pre-ESXi550-201709101-SG); Workstation 12.x (pre-12.5.8); and Fusion 8.x (pre-8.5.9). The vulnerability is a stack overflow in the remote management function triggered by a specific set of VNC packets, which ...

CVE-2017-4940

The ESXi Host Client in VMware ESXi 6.5 before ESXi650-201712103-SG, 5.5 before ESXi600-201711103-SG and 5.5 before ESXi550-201709102-SG contains a vulnerability that may allow for stored cross-site scripting XSS. An attacker can exploit this vulnerability by injecting Javascript, which might get...

CVE-2017-4943

VMware vCenter Server Appliance vCSA 6.5 before 6.5 U1d contains a local privilege escalation vulnerability via the 'showlog' plugin. Successful exploitation of this issue could result in a low privileged user gaining root level privileges over the appliance base OS...

CVE-2017-4941

VMware ESXi 6.0 before ESXi600-201711101-SG, 5.5 ESXi550-201709101-SG, Workstation 12.x before 12.5.8, and Fusion 8.x before 8.5.9 contain a vulnerability that could allow an authenticated VNC session to cause a stack overflow via a specific set of VNC packets. Successful exploitation of this iss...

VMware VNC Dynamic Resolution Request Code Execution Vulnerability(CVE-2017-4933)

Summary An exploitable code execution vulnerability exists in the remote management functionality of VMware . A specially crafted set of VNC packets can cause a heap overflow resulting in heap corruption. An attacker can create a VNC session to trigger this vulnerability. Tested Versions Vase,...

Vmware ESXi Host Client Cross-Site Scripting Vulnerability

VMware ESXi is a bare-metal virtualization hypervisor from VMware that is installed directly on a physical server and divides the physical server into multiple virtual machines. The program features less disk space, higher reliability and security. A cross-site scripting vulnerability exists in...