CVE-2009-1805

CVE-2009-1805 concerns the VMware Descheduled Time Accounting DoS vulnerability. The issue affects multiple VMware products where the Descheduled Time Accounting Service is not running inside a Windows guest, allowing a guest OS user to cause a denial of service via unknown vectors. Affected prod...

CVE-2011-1787

The CVE-2011-1787 issue is a race condition in VMware HGFS (mount.vmhgfs) within the Host-Guest File System. Affected products include VMware Workstation 7.1.x (prior to 7.1.4), VMware Player 3.1.x (prior to 3.1.4), VMware Fusion 3.1.x (prior to 3.1.3), VMware ESXi 3.5–4.1, and VMware ESX 3.0.3–4...

CVE-2018-6963

CVE-2018-6963 affects VMware Workstation 14.x (pre-14.1.2) and VMware Fusion 10.x (pre-10.1.2). The root cause is a NULL pointer dereference in the RPC handler, enabling a local attacker with limited guest privileges to cause a denial of service on the guest OS. Connected advisories corroborate m...

CVE-2019-5515

VMware has released advisories addressing several critical out-of-bounds and TOCTOU issues across ESXi, Workstation, and Fusion related to the e1000/e1000e virtual network adapters and UHCI USB controllers. The CVEs tied to these flaws include CVE-2019-5515 (e1000/e1000e out-of-bounds write, gues...

CVE-2023-34045

CVE-2023-34045 affects VMware Fusion 13.x before 13.5, with a local privilege-escalation flaw that can be exploited during the first-time install or an upgrade (from the .dmg volume) to gain root privileges. The issue is addressed by VMware in Fusion 13.5 (per VMSA-2023-0022), which provides the ...

CVE-2010-4295

CVE-2010-4295 describes a race condition in the mounting process of vmware-mount that could allow a local host user to gain privileges via temporary files. Affected products include VMware Workstation 7.x (before 7.1.2 on Linux), VMware Player 3.1.x (before 3.1.2 on Linux), VMware Server 2.0.2 (L...

CVE-2012-1666

The CVE-2012-1666 entry describes an untrusted search path vulnerability in VMware Tools components across VMware Workstation (before 8.0.4), VMware Player (before 4.0.4), VMware Fusion (before 4.1.2), VMware View (before 5.1), and VMware ESX (4.1 before U3 and 5.0 before P03). The underlying iss...

CVE-2017-4949

CVE-2017-4949 concerns a use-after-free vulnerability in the VMware NAT service when IPv6 mode is enabled, allowing a guest VM to execute code on the host. Public details specify the issue affects VMware Workstation and Fusion, with IPv6 VMNAT mode not enabled by default. Affected ranges include:...

CVE-2017-4950

VMware Workstation and Fusion contain an integer overflow in the VMware NAT service when IPv6 mode is enabled, potentially causing an out-of-bounds read that can lead to host code execution with additional issues. IPv6 VMNAT mode is not enabled by default. Vendor advisories (VMSA-2018-0004/0005) ...

CVE-2018-6983

The CVE-2018-6983 issue affects VMware Workstation (14.x before 14.1.5; 15.x before 15.0.2) and VMware Fusion (10.x before 10.1.5; 11.x before 11.0.2). The vulnerability is an integer overflow in the virtual network devices, enabling a guest VM to execute code on the host. The root cause and exac...

CVE-2019-5535

CVE-2019-5535 is a network denial-of-service vulnerability in VMware Workstation and Fusion caused by improper handling of certain IPv6 packets. The issue affects Workstation 15.x and Fusion 11.x prior to the fixed versions. From the VMware advisory (VMSA-2019-0014): exploitation requires sending...

CVE-2015-2337

CVE-2015-2337 affects VMware’s TPInt.dll (and related TPView.dll) memory handling. VMware Workstation 10.x before 10.0.6 and 11.x before 11.1.1; VMware Player 6.x before 6.0.6 and 7.x before 7.1.1; and VMware Horizon Client 3.2.x before 3.2.1, 3.3.x, and 5.x local-mode before 5.4.2 on Windows are...

CVE-2015-2338

This CVE set covers VMware’s TPView.dll memory allocation flaw that can cause host-denial-of-service from guest OS on Windows. Affected products and ranges include: VMware Workstation 10.x before 10.0.6 and 11.x before 11.1.1; VMware Player 6.x before 6.0.6 and 7.x before 7.1.1; VMware Horizon Cl...

CVE-2015-2339

CVE-2015-2339 affects VMware TPView.dll memory allocation in Windows-hosted VMware products. Affected: Workstation 10.x before 10.0.6, 11.x before 11.1.1; Player 6.x before 6.0.6, 7.x before 7.1.1; Horizon Client 3.2.x before 3.2.1, 3.3.x, and 5.x before 5.4.2. The flaw (memory allocation issue) ...

CVE-2008-2098

The CVE-2008-2098 entry corresponds to a heap-based buffer overflow in VMware Host-Guest File System (HGFS) sharing. Affected products include VMware Workstation 6.x prior to 6.0.4 (build 93057), VMware Player 2.x prior to 2.0.4 (build 93057), VMware ACE 2.x prior to 2.0.2 (build 93057), and VMwa...

CVE-2009-0177

CVE-2009-0177 is a remote denial-of-service vulnerability in the vmware-authd.exe daemon via excessively long USER or PASS commands. Public-availability details (from VMware VMSA-2009-0005) indicate the issue affects multiple VMware products prior to patched versions, including Workstation 6.5.x ...

CVE-2010-1141

CVE-2010-1141 affects VMware Tools and related VMware host components (Workstation, Player, ACE, Server, Fusion, ESXi/ESX). The flaw is improper access/loading of libraries, enabling a user-assisted remote attacker to trigger arbitrary code execution by convincing a Windows guest OS user to click...

CVE-2011-3868

CVE-2011-3868 affects VMware products: Workstation 7.x before 7.1.5, Player 3.x before 3.1.5, Fusion 3.1.x before 3.1.3, and VMware AMS. A crafted UDF filesystem in an ISO image can lead to remote code execution. Mitigation per the initial description is to update to the listed fixed versions (7....

CVE-2010-4296

CVE-2010-4296 affects VMware products including Workstation 7.x up to 7.1.2 (Linux), Player 3.1.x up to 3.1.2 (Linux), Server 2.0.2 (Linux), and Fusion 3.1.x up to 3.1.2. The issue is a library loading flaw in vmware-mount that lets local host users load arbitrary shared objects with root privile...

CVE-2011-2146

CVE-2011-2146 concerns the VMware Host Guest File System (HGFS) disclosure issue. The description specifies that mount.vmhgfs in VMware Workstation (7.1.x before 7.1.4), VMware Player (3.1.x before 3.1.4), VMware Fusion (3.1.x before 3.1.3), and VMware ESXi/ESX (versions 3.5–4.1) allows guest OS ...

CVE-2012-3288

CVE-2012-3288 affects multiple VMware hosted products via a vulnerability in handling Checkpoint files that may cause memory corruption, allowing arbitrary code execution on the host or a denial of service. Affected: Workstation 7.x (before 7.1.6), 8.x (before 8.0.4); Player 3.x (before 3.1.6), 4...

CVE-2015-2336

CVE-2015-2336 affects VMware products on Windows: TPView.dll/TPInt.dll memory allocation issues in VMware Workstation 10.x before 10.0.6 and 11.x before 11.1.1, VMware Player 6.x before 6.0.6 and 7.x before 7.1.1, and VMware Horizon Client 3.2.x before 3.2.1, 3.3.x, and 5.x local-mode before 5.4....

CVE-2010-1138

CVE-2010-1138 corresponds to an information-disclosure vulnerability in VMware hosted products where a guest can cause the host vmware-vmx memory to be exposed via the virtual networking stack when processing network packets. Affected products include VMware Workstation/Player/ACE/Server/Fusion a...

CVE-2012-2449

CVE-2012-2449 describes an out-of-bounds memory write in the virtual floppy device configuration that could crash the VMX process or allow code execution on the host, given administrative guest privileges. Affected VMware products include Workstation 8.x (pre-8.0.3), Player 4.x (pre-4.0.3), Fusio...

CVE-2017-4934

CVE-2017-4934 affects VMware Workstation 12.x (pre-12.5.8) and VMware Fusion 8.x (pre-8.5.9), with a heap buffer‑overflow in the VMNAT device that may allow a guest to execute code on the host. The issue is local: an attacker on the guest can trigger code execution in the host context. Related ad...

CVE-2017-4938

CVE-2017-4938 is a guest RPC NULL pointer dereference vulnerability in VMware Workstation 12.x before 12.5.8 and VMware Fusion 8.x before 8.5.9 that can crash VMs when exploited with normal user privileges. VMware issued VMSA-2017-0018 and updates; remediation is to upgrade to Workstation 12.5.8 ...

CVE-2012-2450

CVE-2012-2450 covers VMware products (Workstation 8.x before 8.0.3, Player 4.x before 4.0.3, Fusion 4.x before 4.1.2, ESXi/ESX 3.5–5.0) with an improper handling/registration of SCSI devices. The flaw enables an untrusted guest user with admin privileges to trigger an out‑of‑bounds memory write, ...

CVE-2016-5329

CVE-2016-5329 affects VMware Fusion 8.x before 8.5.0 on macOS with System Integrity Protection (SIP) enabled. The issue is an information-disclosure vulnerability that allows a local attacker to obtain kernel memory addresses and bypass kASLR. The vulnerability is tied to Fusion behavior prior to...

CVE-2018-6962

CVE-2018-6962 affects VMware Fusion (10.x before 10.1.2). The issue is a signature bypass vulnerability that may lead to local privilege escalation. VMware’s advisory VMSA-2018-0013 confirms the affected product is Fusion 10.x and provides the remediation: upgrade to Fusion 10.1.2 (and related pa...

CVE-2024-22269

CVE-2024-22269 describes an information-disclosure vulnerability in the vbluetooth device affecting VMware Workstation and Fusion. According to the provided documents, a malicious actor with local administrative privileges inside a virtual machine may read privileged information stored in hypervi...

CVE-2009-3282

Summary of findings (CVE-2009-3282 and related CVE-2009-3281) : VMware Fusion before 2.0.6 (build 196839) is affected by two issues in the vmx86 kernel extension. CVE-2009-3282 is an integer overflow that allows an unprivileged user on the host to cause a denial of service. CVE-2009-3281 is a ker...