CVE-2017-4898

VMware Workstation Pro/Player 12.x before 12.5.3 contains a DLL loading vulnerability that occurs due to the "vmware-vmx" process loading DLLs from a path defined in the local environment-variable. Successful exploitation of this issue may allow normal users to escalate privileges to System in th...

CVE-2017-4899

VMware Workstation Pro/Player 12.x before 12.5.3 contains a security vulnerability that exists in the SVGA driver. An attacker may exploit this issue to crash the VM or trigger an out-of-bound read. Note: This issue can be triggered only when the host has no graphics card or no graphics drivers a...

CVE-2017-4905

VMware ESXi 6.5 without patch ESXi650-201703410-SG, 6.0 U3 without patch ESXi600-201703401-SG, 6.0 U2 without patch ESXi600-201703403-SG, 6.0 U1 without patch ESXi600-201703402-SG, 5.5 without patch ESXi550-201703401-SG; Workstation Pro / Player 12.x prior to 12.5.5; and Fusion Pro / Fusion 8.x...

CVE-2017-4902

VMware ESXi 6.5 without patch ESXi650-201703410-SG and 5.5 without patch ESXi550-201703401-SG; Workstation Pro / Player 12.x prior to 12.5.5; and Fusion Pro / Fusion 8.x prior to 8.5.6 have a Heap Buffer Overflow in SVGA. This issue may allow a guest to execute code on the host...

CVE-2017-4903

VMware ESXi 6.5 without patch ESXi650-201703410-SG, 6.0 U3 without patch ESXi600-201703401-SG, 6.0 U2 without patch ESXi600-201703403-SG, 6.0 U1 without patch ESXi600-201703402-SG, and 5.5 without patch ESXi550-201703401-SG; Workstation Pro / Player 12.x prior to 12.5.5; and Fusion Pro / Fusion 8...

CVE-2017-4900

VMware Workstation Pro/Player 12.x before 12.5.3 contains a NULL pointer dereference vulnerability that exists in the SVGA driver. Successful exploitation of this issue may allow attackers with normal user privileges to crash their VMs...

CVE-2017-4904

The XHCI controller in VMware ESXi 6.5 without patch ESXi650-201703410-SG, 6.0 U3 without patch ESXi600-201703401-SG, 6.0 U2 without patch ESXi600-201703403-SG, 6.0 U1 without patch ESXi600-201703402-SG, and 5.5 without patch ESXi550-201703401-SG; Workstation Pro / Player 12.x prior to 12.5.5; an...

CVE-2017-4898

CVE-2017-4898 affects VMware Workstation Pro/Player 12.x prior to 12.5.3. The issue is a DLL loading vulnerability in the vmware-vmx process caused by loading DLLs from a path defined in a local environment variable, which may allow a local attacker to escalate privileges to SYSTEM on the host. V...

CVE-2017-4899

VMware Workstation Pro/Player 12.x prior to 12.5.3 contains a vulnerability in the SVGA driver (CVE-2017-4899) that can crash the guest VM or trigger an out-of-bounds read. Exploitation is described as local (within a VM) and is conditioned on the host lacking graphics hardware/drivers. The issue...

CVE-2017-4900

VMware Workstation Pro/Player 12.x prior to 12.5.3 contains a NULL pointer dereference in the SVGA driver. The issue allows a local attacker with normal user privileges to crash the guest VM (and potentially disrupt host stability). VMware’s VMSA-2017-0003 documents three related CVEs (including ...

CVE-2017-4902

CVE-2017-4902 refers to a Heap Buffer Overflow in SVGA that can allow a guest to execute code on the host. Affected products are: VMware ESXi 6.5 (without patch ESXi650-201703410-SG) and ESXi 5.5 (without patch ESXi550-201703401-SG); VMware Workstation Pro/Player 12.x before 12.5.5; VMware Fusion...

The CIS Critical Controls Explained- Control 8: Malware Defenses

This is a continuation of our CIS critical security controls blog series. Workstations form the biggest threat surface in any organization. The CIS Critical Security Controls include workstation and user-focused endpoint security in several of the controls, but Control 8 Malware Defenses is the...

RedHat Update for sudo RHSA-2017:1382-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Multiple VMware Workstation Products DLL Loading Local Privilege Escalation Vulnerability - Linux

VMware Workstation and Horizon View Client are prone to a remote code execution RCE vulnerability Windows. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Multiple VMware Workstation Products DLL Loading Local Privilege Escalation Vulnerability - Linux

VMware Workstation and Horizon View Client are prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

VMware Workstation Multiple Security Vulnerabilities (VMSA-2017-0003, VMSA-2017-0008, VMSA-2017-0015) - Windows

VMware Workstation updates resolve multiple security vulnerabilities Windows SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Unauthorized Password Change

dolibarr/dolibarr is vulnerable to unauthorized password changes. The library does not require the current password for validation before changing to a new password, allowing a malicious user to obtain access to an unattended workstation...

VMware Workstation 12.x < 12.5.6 vstor2 Driver NULL Pointer Dereference DoS (VMSA-2017-0009)

The version of VMware Workstation installed on the remote Windows host is 12.x prior to 12.5.5. It is, therefore, affected by a NULL pointer dereference flaw in the vstor2 driver. A local attacker can exploit this to cause a denial of service condition. C Tenable Network Security, Inc...

VMware Workstation 12.x < 12.5.6 Insecure Library Loading Privilege Escalation (VMSA-2017-0009) (Linux)

The version of VMware Workstation installed on the remote Linux host is 12.x prior to 12.5.6. It is, therefore, affected by a privilege escalation vulnerability in the ALSA sound driver due to insecurely loading shared libraries via the '.asoundrc' configuration file. A local attacker can exploit...

VMware Workstation Pro for Linux and VMware Workstation Player for Linux Elevation of Privilege Vulnerability

VMware Workstation Pro for Linux and VMware Workstation Player for Linux are both Linux-based virtual machine software products from VMware.VMware Workstation Pro for Linux is one of the VMware Workstation Pro for Linux is one of the professional editions; VMware Workstation Player for Linux is a...