Support Content Notification - Support Portal

VMSA-2017-0009

VMware Workstation update addresses multiple security issues

VMware Security Advisory

VMware Security Advisory Advisory ID:

VMSA-2017-0009

VMware Security Advisory Severity:

Important

VMware Security Advisory Synopsis:

VMware Workstation update addresses multiple security issues

VMware Security Advisory Issue date:

2017-05-18

VMware Security Advisory Updated on:

2017-05-18 (Initial Advisory)

VMware Security Advisory CVE numbers:

CVE-2017-4915, CVE-2017-4916

1. Summary

VMware Workstation update addresses multiple security issues

2. Relevant Products

VMware Workstation Pro/Player

3. Problem Description

a. VMware Workstation Insecure library loading vulnerability

VMware Workstation Pro/Player contains an insecure library loading vulnerability via ALSA sound driver configuration files. Successful exploitation of this issue may allow unprivileged host users to escalate their privileges to root in a Linux host machine.

VMware would like to thank Jann Horn of Google Project Zero for reporting this issue to us.

The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the identifier CVE-2017-4915 to this issue.

Column 5 of the following table lists the action required to remediate the vulnerability in each release, if a solution is available.

VMware Product

Product Version

Running on

Severity

Replace with/ Apply Patch

Workaround

VMware ProductVMware Workstation Pro

Product Version12.x

Running on Linux

SeverityImportant

Replace with/ Apply Patch12.5.6

WorkaroundNone

VMware ProductVMware Workstation Player

Product Version12.x

Running on Linux

SeverityImportant

Replace with/ Apply Patch12.5.6

WorkaroundNone

b. VMware Workstation NULL pointer dereference vulnerability

VMware Workstation Pro/Player contains a NULL pointer dereference vulnerability that exists in the vstor2 driver. Successful exploitation of this issue may allow host users with normal user privileges to trigger a denial-of-service in a Windows host machine.

VMware would like to thank Borja Merino for reporting this issue to us.

The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the identifier CVE-2017-4916 to this issue.

Column 5 of the following table lists the action required to remediate the vulnerability in each release, if a solution is available.