CVSS: 3.3EPSS: 0%CPEs: 16EXPL: 0CVE-2015-1043
https://notcve.org/view.php?id=CVE-2015-1043
The Host Guest File System (HGFS) in VMware Workstation 10.x before 10.0.5, VMware Player 6.x before 6.0.5, and VMware Fusion 6.x before 6.0.5 and 7.x before 7.0.1 allows guest OS users to cause a guest OS denial of service via unspecified vectors. Host Guest File System (HGFS) en VMware Workstation 10.x anterior a 10.0.5, VMware Player 6.x anterior a 6.0.5, y VMware Fusion 6.x anterior a 6.0.5 y 7.x anterior a 7.0.1 permite a usuarios del sistema operativo invitado causar una denegación de servicio del sistema operativo invitado a través de vectores no especificados. • http://secunia.com/advisories/62551 http://www.securityfocus.com/bid/72337 http://www.securitytracker.com/id/1031644 http://www.vmware.com/security/advisories/VMSA-2015-0001.html https://exchange.xforce.ibmcloud.com/vulnerabilities/100934 • CWE-20: Improper Input Validation •
CVSS: 9.3EPSS: 1%CPEs: 48EXPL: 0CVE-2012-3288
https://notcve.org/view.php?id=CVE-2012-3288
VMware Workstation 7.x before 7.1.6 and 8.x before 8.0.4, VMware Player 3.x before 3.1.6 and 4.x before 4.0.4, VMware Fusion 4.x before 4.1.3, VMware ESXi 3.5 through 5.0, and VMware ESX 3.5 through 4.1 allow user-assisted remote attackers to execute arbitrary code on the host OS or cause a denial of service (memory corruption) on the host OS via a crafted Checkpoint file. VMware Workstation v7.x antes de v7.1.6 y v8.x antes de v8.0.4, VMware Player v3.x antes de v3.1.6 y v4.x antes de v4.0.4, VMware Fusion v4.x antes de 4.1.3, VMware ESXi v3.5 a v5.0 y VMware ESX v3.5 a v4.1 permite ejecutar código de su elección en el sistema operativo anfitrión a atacantes remotos (con cierta ayuda de usuarios locales) o causar una denegación de servicio (por corrupción de memoria) en el sistema operativo anfitrión a través de un archivo Checkpoint modificado. • http://www.vmware.com/security/advisories/VMSA-2012-0011.html https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17178 • CWE-20: Improper Input Validation •
CVSS: 9.3EPSS: 27%CPEs: 18EXPL: 0CVE-2011-3868
https://notcve.org/view.php?id=CVE-2011-3868
Buffer overflow in VMware Workstation 7.x before 7.1.5, VMware Player 3.x before 3.1.5, VMware Fusion 3.1.x before 3.1.3, and VMware AMS allows remote attackers to execute arbitrary code via a crafted UDF filesystem in an ISO image. Desbordamiento de bufer en VMware Workstation 7.x anterior a v7.1.5, VMware Player v3.x anterior a v3.1.5, VMware Fusion v3.1.x anterior v3.1.3, y VMware AMS permite a atacantes remotos ejecutar código arbitrario mediante un systema de ficheros manipulado UDF en una imagen ISO • http://osvdb.org/76060 http://secunia.com/advisories/46241 http://security.gentoo.org/glsa/glsa-201209-25.xml http://www.securityfocus.com/archive/1/520005/100/0/threaded http://www.securityfocus.com/bid/49942 http://www.securitytracker.com/id?1026139 http://www.vmware.com/security/advisories/VMSA-2011-0011.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.2EPSS: 0%CPEs: 16EXPL: 0CVE-2010-4296
https://notcve.org/view.php?id=CVE-2010-4296
vmware-mount in VMware Workstation 7.x before 7.1.2 build 301548 on Linux, VMware Player 3.1.x before 3.1.2 build 301548 on Linux, VMware Server 2.0.2 on Linux, and VMware Fusion 3.1.x before 3.1.2 build 332101 does not properly load libraries, which allows host OS users to gain privileges via vectors involving shared object files. vmware-mount en VMware Workstation 7.x anteriores a la 7.1.2 build 301548 en Linux, VMware Player 3.1.x anteriores a la 3.1.2 build 301548 en Linux, VMware Server 2.0.2 en Linux, y VMware Fusion 3.1.x anteriores a la 3.1.2 build 332101 no carga apropiadamente las librerías, lo que permite a los usuarios del SO base escalar privilegios a través de vectores que involucran ficheros objeto compartidos. • http://lists.vmware.com/pipermail/security-announce/2010/000112.html http://osvdb.org/69584 http://secunia.com/advisories/42453 http://secunia.com/advisories/42482 http://www.securityfocus.com/archive/1/514995/100/0/threaded http://www.securityfocus.com/bid/45168 http://www.securitytracker.com/id?1024819 http://www.securitytracker.com/id?1024820 http://www.vmware.com/security/advisories/VMSA-2010-0018.html http://www.vupen.com/english/advisories/2010/3116 • CWE-863: Incorrect Authorization •
CVSS: 9.3EPSS: 11%CPEs: 34EXPL: 0CVE-2010-4294
https://notcve.org/view.php?id=CVE-2010-4294
The frame decompression functionality in the VMnc media codec in VMware Movie Decoder before 6.5.5 build 328052 and 7.x before 7.1.2 build 301548, VMware Workstation 6.5.x before 6.5.5 build 328052 and 7.x before 7.1.2 build 301548 on Windows, VMware Player 2.5.x before 2.5.5 build 246459 and 3.x before 3.1.2 build 301548 on Windows, and VMware Server 2.x on Windows does not properly validate an unspecified size field, which allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a crafted video file. La funcionalidad de descompresión de tramas ("frames") en el codec VMnc media de VMware Movie Decoder en versiones anteriores a la 6.5.5 build 328052 y 7.x anteriores a la 7.1.2 build 301548, VMware Workstation 6.5.x anteriores a la 6.5.5 build 328052 y 7.x anteriores a la 7.1.2 build 301548 en Windows, VMware Player 2.5.x anteriores a la 2.5.5 build 246459 y 3.x anteriores a la 3.1.2 build 301548 en Windows, y VMware Server 2.x en Windows no valida apropiadamente un campo de tamaño sin especificar, lo que permite a atacantes remotos ejecutar código de su elección o provocar una denegación de servicio (corrupción de la memoria dinámica) a través de un archivo de vídeo modificado. • http://lists.vmware.com/pipermail/security-announce/2010/000112.html http://osvdb.org/69596 http://secunia.com/advisories/42482 http://www.securityfocus.com/archive/1/514995/100/0/threaded http://www.securityfocus.com/bid/45169 http://www.securitytracker.com/id?1024819 http://www.vmware.com/security/advisories/VMSA-2010-0018.html http://www.vupen.com/english/advisories/2010/3116 • CWE-94: Improper Control of Generation of Code ('Code Injection') •