VMware product updates address multiple important security issues

a. DLL hijacking issue in Windows-based VMware Tools

A DLL hijacking vulnerability is present in the VMware Tools “Shared Folders” (HGFS) feature running on Microsoft Windows. Exploitation of this issue may lead to arbitrary code execution with the privileges of the victim. In order to exploit this issue, the attacker would need write access to a network share and they would need to entice the local user into opening their document.

There are no known workarounds for this issue.

VMware would like to thank Yorick Koster of Securify B.V. for reporting this issue to us.

The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the identifier CVE-2016-5330 to this issue.

Column 5 of the following table lists the action required to remediate the vulnerability in each release, if a solution is available.