VMware Patches Critical Vulnerabilities in vSphere Data Protection

VMware fixed two critical vulnerabilities in its vSphere Data Protection solution this week that could have allowed an attacker to execute commands on the virtual appliance, among other outcomes. The Department of Homeland Security’s CERT encouraged users and admins on Wednesday to apply the...

VMware Workstation 12 Pro Denial Of Service

/ Title: NULL pointer dereference vulnerability in vstor2 driver VMware Workstation Pro/Player CVE: 2017-4916 VMSA-2017-0009 Author: Borja Merino @BorjaMerino Date: May 18, 2017 Tested on: Windows 10 Pro and Windows 7 Pro SP1 with VMwareAr Workstation 12 Pro 12.5.5 build-5234757 Affected: VMware...

Horizon View Client update addresses a command injection vulnerability

Horizon View Client command injection vulnerability VMware Horizon View Client contains a command injection vulnerability in the service startup script. Successful exploitation of this issue may allow unprivileged users to escalate their privileges to root on the Mac OSX system where the client i...

VMware Workstation 12 Pro - Denial of Service

/ Title: NULL pointer dereference vulnerability in vstor2 driver VMware Workstation Pro/Player CVE: 2017-4916 VMSA-2017-0009 Author: Borja Merino @BorjaMerino Date: May 18, 2017 Tested on: Windows 10 Pro and Windows 7 Pro SP1 with VMware® Workstation 12 Pro 12.5.5 build-5234757 Affected: VMware...

VMware Workstation 12 Pro - Denial of Service

VMware Workstation 12 Pro - Denial of Service / Title: NULL pointer dereference vulnerability in vstor2 driver VMware Workstation Pro/Player CVE: 2017-4916 VMSA-2017-0009 Author: Borja Merino @BorjaMerino Date: May 18, 2017 Tested on: Windows 10 Pro and Windows 7 Pro SP1 with VMware® Workstation ...

VMware Workstation 12 Pro - Denial of Service Exploit

Exploit for windows platform in category dos / poc / Title: NULL pointer dereference vulnerability in vstor2 driver VMware Workstation Pro/Player CVE: 2017-4916 VMSA-2017-0009 Author: Borja Merino @BorjaMerino Date: May 18, 2017 Tested on: Windows 10 Pro and Windows 7 Pro SP1 with VMware®...

Code injection

The XHCI controller in VMware ESXi 6.5 without patch ESXi650-201703410-SG, 6.0 U3 without patch ESXi600-201703401-SG, 6.0 U2 without patch ESXi600-201703403-SG, 6.0 U1 without patch ESXi600-201703402-SG, and 5.5 without patch ESXi550-201703401-SG; Workstation Pro / Player 12.x prior to 12.5.5; an...

CVE-2017-4902

VMware ESXi 6.5 without patch ESXi650-201703410-SG and 5.5 without patch ESXi550-201703401-SG; Workstation Pro / Player 12.x prior to 12.5.5; and Fusion Pro / Fusion 8.x prior to 8.5.6 have a Heap Buffer Overflow in SVGA. This issue may allow a guest to execute code on the host...

CVE-2017-4905

VMware ESXi 6.5 without patch ESXi650-201703410-SG, 6.0 U3 without patch ESXi600-201703401-SG, 6.0 U2 without patch ESXi600-201703403-SG, 6.0 U1 without patch ESXi600-201703402-SG, 5.5 without patch ESXi550-201703401-SG; Workstation Pro / Player 12.x prior to 12.5.5; and Fusion Pro / Fusion 8.x...

CVE-2017-4898

VMware Workstation Pro/Player 12.x before 12.5.3 contains a DLL loading vulnerability that occurs due to the "vmware-vmx" process loading DLLs from a path defined in the local environment-variable. Successful exploitation of this issue may allow normal users to escalate privileges to System in th...

CVE-2017-4899

VMware Workstation Pro/Player 12.x before 12.5.3 contains a security vulnerability that exists in the SVGA driver. An attacker may exploit this issue to crash the VM or trigger an out-of-bound read. Note: This issue can be triggered only when the host has no graphics card or no graphics drivers a...

Null pointer dereference

VMware Workstation Pro/Player 12.x before 12.5.3 contains a NULL pointer dereference vulnerability that exists in the SVGA driver. Successful exploitation of this issue may allow attackers with normal user privileges to crash their VMs...

CVE-2017-4900

VMware Workstation Pro/Player 12.x before 12.5.3 contains a NULL pointer dereference vulnerability that exists in the SVGA driver. Successful exploitation of this issue may allow attackers with normal user privileges to crash their VMs...

CVE-2017-4904

The XHCI controller in VMware ESXi 6.5 without patch ESXi650-201703410-SG, 6.0 U3 without patch ESXi600-201703401-SG, 6.0 U2 without patch ESXi600-201703403-SG, 6.0 U1 without patch ESXi600-201703402-SG, and 5.5 without patch ESXi550-201703401-SG; Workstation Pro / Player 12.x prior to 12.5.5; an...

Heap overflow

VMware ESXi 6.5 without patch ESXi650-201703410-SG and 5.5 without patch ESXi550-201703401-SG; Workstation Pro / Player 12.x prior to 12.5.5; and Fusion Pro / Fusion 8.x prior to 8.5.6 have a Heap Buffer Overflow in SVGA. This issue may allow a guest to execute code on the host...

CVE-2017-4904

The XHCI controller in VMware ESXi 6.5 without patch ESXi650-201703410-SG, 6.0 U3 without patch ESXi600-201703401-SG, 6.0 U2 without patch ESXi600-201703403-SG, 6.0 U1 without patch ESXi600-201703402-SG, and 5.5 without patch ESXi550-201703401-SG; Workstation Pro / Player 12.x prior to 12.5.5; an...

CVE-2017-4898

VMware Workstation Pro/Player 12.x before 12.5.3 contains a DLL loading vulnerability that occurs due to the "vmware-vmx" process loading DLLs from a path defined in the local environment-variable. Successful exploitation of this issue may allow normal users to escalate privileges to System in th...

Design/Logic Flaw

VMware Workstation Pro/Player 12.x before 12.5.3 contains a security vulnerability that exists in the SVGA driver. An attacker may exploit this issue to crash the VM or trigger an out-of-bound read. Note: This issue can be triggered only when the host has no graphics card or no graphics drivers a...

CVE-2017-4899

VMware Workstation Pro/Player 12.x before 12.5.3 contains a security vulnerability that exists in the SVGA driver. An attacker may exploit this issue to crash the VM or trigger an out-of-bound read. Note: This issue can be triggered only when the host has no graphics card or no graphics drivers a...

Code injection

VMware ESXi 6.5 without patch ESXi650-201703410-SG, 6.0 U3 without patch ESXi600-201703401-SG, 6.0 U2 without patch ESXi600-201703403-SG, 6.0 U1 without patch ESXi600-201703402-SG, and 5.5 without patch ESXi550-201703401-SG; Workstation Pro / Player 12.x prior to 12.5.5; and Fusion Pro / Fusion 8...