PT-2017-16221 · Vmware · Vmware Workstation

Published 2017-11-17 · Updated 2017-12-03 · CVE-2017-4939

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions VMware Workstation versions 12.x through 12.5.7

Description The issue exists due to some DLL files loaded by the application improperly, which may allow an attacker to load a DLL file of their choosing that could execute arbitrary code. This is a result of a DLL hijacking issue in the installer.

Recommendations For versions 12.x through 12.5.7, update to version 12.5.8 or later to resolve the issue.

Fix

Untrusted Search Path

Weakness Enumeration

CWE-426

Related Identifiers

CVE-2017-4939

Affected Products

Vmware Workstation

References · 4

• https://osv.dev/vulnerability/CVE-2017-4939 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-4939 · Security Note
• https://vmware.com/security/advisories/VMSA-2017-0018.html · Vendor Advisory
• http://securityfocus.com/bid/101890 · Note