KLA10934 Arbitrary code execution and denial of service vulnerability in VMware products

An unspecified vulnerability was found in VMware Workstation Pro 12.x before 12.5.2, VMware Workstation Player 12.x before 12.5.2 and VMware Fusion, Fusion Pro 8.x before 8.5.2. By exploiting this vulnerability malicious users can execute arbitrary code on the host OS or cause a denial of service. This vulnerability can be exploited remotely via unspecified vectors.

Technical details

This vulnerability was found in the drag-and-drop (DnD) function.

Original advisories

VMSA-2016-0019

Related products

VMware-Workstation

VMware-Player

VMware-Fusion

CVE list

CVE-2016-7461 high

Solution

Update to the latest version

Get VMware products

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• DoS

Denial of service. Exploitation of vulnerabilities with this impact can lead to loss of system availability or critical functional fault.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

Affected Products

• VMware Workstation Pro 12.x before 12.5.2VMware Workstation Player 12.x before 12.5.2VMware Fusion and Fusion Pro 8.x before 8.5.2