VMware Workstation 12.x < 12.5.5 Multiple Vulnerabilities (VMSA-2017-0006)

The version of VMware Workstation installed on the remote Windows host is 12.x prior to 12.5.5. It is, therefore, affected by multiple vulnerabilities : - A heap buffer overflow condition exists due to improper validation of certain input. An attacker on the guest can exploit this to cause a deni...

(Pwn2Own) VMware Workstation Uninitialized Memory Information Disclosure Vulnerability

This vulnerability allows local attackers to disclose sensitive information on vulnerable installations of VMware Workstation. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the...

VMSA-2017-0006 : VMware ESXi, Workstation and Fusion updates address critical and moderate security issues

a. ESXi, Workstation, Fusion SVGA memory corruption ESXi, Workstation, Fusion have a heap buffer overflow and uninitialized stack memory usage in SVGA. These issues may allow a guest to execute code on the host. VMware would like to thank ZDI and Team 360 Security from Qihoo for reporting these...

VMware Workstation 12.x < 12.5.5 Multiple Vulnerabilities (VMSA-2017-0006) (Linux)

The version of VMware Workstation installed on the remote Linux host is 12.x prior to 12.5.5. It is, therefore, affected by multiple vulnerabilities : - A heap buffer overflow condition exists due to improper validation of certain input. An attacker on the guest can exploit this to cause a denial...

VMware Workstation SVGA Heap-based Buffer Overflow Privilege Escalation Vulnerability

This vulnerability allows local attackers to execute arbitrary code on vulnerable installations of VMware Workstation. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling...

VMware Workstation SVGA Heap-based Buffer Overflow Privilege Escalation Vulnerability

This vulnerability allows local attackers to execute arbitrary code on vulnerable installations of VMware Workstation. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling...

(Pwn2Own) VMware Workstation SVGA Uninitialized Memory Privilege Escalation Vulnerability

This vulnerability allows local attackers to execute arbitrary code on vulnerable installations of VMware Workstation. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling...

VMware Patches Pwn2Own VM Escape Vulnerabilities

VMware on Tuesday patched a series of vulnerabilities uncovered earlier this month at Pwn2Own. The flaws enabled an attacker to execute code on a workstation and carry out a virtual machine escape to attack a host server. Monty Ijzerman, manager of the company’s Security Response Center, confirme...

VMware Releases Security Updates

VMware has released security updates to address vulnerabilities in ESXi, Workstation, and Fusion. Exploitation of one of these vulnerabilities could allow a remote attacker to take control of an affected system. Users and administrators are encouraged to review VMware Security Advisory...

VMSA-2017-0006:VMware ESXi, Workstation and Fusion updates address CRITICAL and MEDIUM security issues

VMSA-2017-0006 VMware ESXi, Workstation and Fusion updates address critical and moderate security issues VMware Security Advisory VMware Security Advisory Advisory ID: VMSA-2017-0006 VMware Security Advisory Severity: Critical VMware Security Advisory Synopsis: VMware ESXi, Workstation and Fusion...

VMware Workstation 12.x < 12.5.4 Drag-and-Drop Feature Guest-to-Host Code Execution (VMSA-2017-0005)

The version of VMware Workstation installed on the remote Windows host is 12.x prior to 12.5.4. It is, therefore, affected by a guest-to-host arbitrary code execution vulnerability in the drag-and-drop DND functionality due to an out-of-bounds memory access error. An attacker within a guest can...

VMware Workstation 12.x < 12.5.4 Drag-and-Drop Feature Guest-to-Host Code Execution (VMSA-2017-0005) (Linux)

The version of VMware Workstation installed on the remote Linux host is 12.x prior to 12.5.4. It is, therefore, affected by a guest-to-host arbitrary code execution vulnerability in the drag-and-drop DND functionality due to an out-of-bounds memory access error. An attacker within a guest can...

RedHat Update for openjpeg RHSA-2017:0559-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Information disclosure

DNS client in Microsoft Windows 8.1; Windows Server 2012 R2, Windows RT 8.1; Windows 10 Gold, 1511, and 1607; and Windows Server 2016 fails to properly process DNS queries, which allows remote attackers to obtain sensitive information via 1 convincing a workstation user to visit an untrusted...

Multiple VMware Workstation Product DLL Load Remote Code Execution Vulnerability

VMware Workstation is a virtual machine software product from VMware. A DLL loading remote code execution vulnerability exists in multiple VMware Workstation products. An attacker can exploit this vulnerability to execute arbitrary code with elevated privileges, and a failed attack could result i...

Multiple VMware Workstation Product Denial of Service Vulnerabilities

VMware Workstation is a virtual machine software product from VMware. A denial of service vulnerability exists in multiple VMware Workstation products. A remote attacker could exploit the vulnerability to submit a special request that would crash the application...

SUSE SLES11 Security Update : open-vm-tools (SUSE-SU-2017:0705-1)

This update for open-vm-tools to 10.1.0 stable brings features, fixes bugs and security issues : - New vmware-namespace-cmd command line utility - GTK3 support - Common Agent Framework CAF - Guest authentication with xmlsec1 - Sub-command to push updated network information to the host on demand ...

Multiple VMware Workstation Product Out-of-Bounds Read Denial of Service Vulnerabilities

VMware Workstation is a virtual machine software product from VMware. An out-of-bounds read denial of service vulnerability exists in multiple VMware Workstation products. An attacker could exploit this vulnerability to crash a virtual machine, resulting in a denial of service...

Windows DNS Query Information Disclosure Vulnerability

An information disclosure vulnerability exists when Windows dnsclient fails to properly handle requests. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user’s system. There are multiple ways an attacker could exploit the vulnerability: ...

VMware Releases Security Updates

VMware has released security updates to address a vulnerability in Workstation and Fusion. A remote attacker could exploit this vulnerability and take control of an affected system. Users and administrators are encouraged to review VMware Security Advisory VMSA-2017-0005 and apply the necessary...