VMware Workstation Pro 12.x before 12.5.0 and VMware Workstation Player 12.x before 12.5.0 on Windows, when Cortado ThinPrint virtual printing is enabled, allow guest OS users to execute arbitrary code on the host OS or cause a denial of service (host OS memory corruption) via TrueType fonts embedded in EMFSPOOL.

The version of VMware Workstation installed on the remote host is 12.x prior to 12.5.0. It is, therefore, affected by multiple vulnerabilities :

  - A heap buffer overflow condition exists in Cortado     ThinPrint due to improper validation of user-supplied     input. An attacker on the guest can exploit this to     cause a denial of service condition or the execution of     arbitrary code on the host system. (CVE-2016-7081)

  - A memory corruption issue exists in Cortado Thinprint     due to improper handling of specially crafted EMF files.
    An attacker on the guest can exploit this to cause a     denial of service condition or the execution of     arbitrary code on the host system. (CVE-2016-7082)

  - A memory corruption issue exists in Cortado Thinprint     due to improper handling of TrueType fonts embedded in     EMFSPOOL. An attacker on the guest can exploit this to     cause a denial of service condition or the execution of     arbitrary code on the host system. (CVE-2016-7083)

  - A memory corruption issue exists in Cortado Thinprint     due to improper handling of specially crafted JPEG2000     images. An attacker on the guest can exploit this to     cause a denial of service condition or the execution of     arbitrary code on the host system. (CVE-2016-7084)

  - A flaw exits due to improper loading of some dynamic     link library (DLL) files that allows an attacker to load     a DLL file and thereby execute arbitrary code.
    (CVE-2016-7085)

  - A flaw exists in the Workstation installer due to     insecure loading of executables. An attacker can exploit     this, via a crafted application named 'setup64.exe'     inserted into the same directory as the installer, to     execute arbitrary code. (CVE-2016-7086)

a. VMware Workstation heap-based buffer overflow vulnerabilities via    Cortado ThinPrint

VMware Workstation contains vulnerabilities that may allow a windows
-based virtual machine (VM) to trigger heap-based buffer overflows in the windows-based hypervisor running VMware workstation that the VM resides on. Exploitation of this issue may lead to arbitrary code execution in the hypervisor OS.

Exploitation is only possible if virtual printing has been enabled in VMware Workstation. This feature is not enabled by default.
VMware Knowledge Base article 2146810 documents the procedure for enabling and disabling this feature.

VMware would like to thank E0DB6391795D7F629B5077842E649393 working with Trend Micro's Zero Day Initiative for reporting this issue to us.

The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the identifier CVE-2016-7081 to this issue.

b. VMware Workstation memory corruption vulnerabilities via Cortado    Thinprint

VMware Workstation contains vulnerabilities that may allow a windows
-based virtual machine (VM) to corrupt memory in the windows-based hypervisor running VMware workstation that the VM resides on. These include TrueType fonts embedded in EMFSPOOL (CVE-2016-7083), and JPEG2000 images (CVE-2016-7084) in tpview.dll. Exploitation of these issues may lead to arbitrary code execution in the hypervisor OS.

Exploitation is only possible if virtual printing has been enabled in VMware Workstation. This feature is not enabled by default.
VMware Knowledge Base article 2146810 documents the procedure for enabling and disabling this feature.

VMware would like to thank Mateusz Jurczyk of Google's Project Zero for reporting these issues to us.

The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the identifiers CVE-2016-7083, and CVE-2016-7084 to these issues.

c. VMware Tools NULL pointer dereference vulnerabilities

The graphic acceleration functions used in VMware Tools for OSX handle memory incorrectly. Two resulting NULL pointer dereference vulnerabilities may allow for local privilege escalation on Virtual Machines that run OSX.

The issues can be remediated by installing a fixed version of VMware Tools on affected OSX VMs directly. Alternatively the fixed version of Tools can be installed through ESXi or Fusion after first updating to a version of ESXi or Fusion that ships with a fixed version of VMware Tools.

The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the identifiers CVE-2016-7079 and CVE-2016-7080 to these issues.

VMware would like to thank Dr. Fabien Duchene 'FuzzDragon' and Jian Zhu for independently reporting these issues to VMware.

d. VMware Workstation installer DLL hijacking issue

Workstation Pro/Player installer contains a DLL hijacking issue that exists due to some DLL files loaded by the application improperly.
This issue may allow an unauthenticated remote attacker to load this DLL file of the attacker's choosing that could execute arbitrary code.

e. VMware Workstation installer insecure executable loading    vulnerability

Workstation installer contains an insecure executable loading vulnerability that may allow an attacker to execute any exe file placed in the same directory as installer with the name 'setup64.exe'.Successfully exploiting this issue may allow attackers to escalate their privileges and execute arbitrary code.

VMware would like to thank Adam Bridge for reporting this issue to us.

The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the identifier CVE-2016-7086 to this issue.

f. Workstation EMF file handling memory corruption vulnerability via Cortado ThinPrint

VMware Workstation contains a vulnerability that may allow a Windows
-based virtual machine (VM) to corrupt memory. This issue occurs due to improper handling of EMF files in tpview.dll. Exploitation of this issue may lead to arbitrary code execution in the hypervisor OS.

The severity of this issue has changed to Low from Critical as the exploitation of the issue requires a custom registry value to be added on the host machine.

Exploitation is only possible if virtual printing has been enabled in VMware Workstation. This feature is not enabled by default.
VMware Knowledge Base article 2146810 documents the procedure for enabling and disabling this feature.

VMware would like to thank Mateusz Jurczyk of Google's Project Zero and Yakun Zhang of McAfee for individually reporting this issue to us.

The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the identifier CVE-2016-7082 to this issue.

ID	Name	Product	Family	Severity
93521	VMware Workstation 12.x < 12.5.0 Multiple Vulnerabilities (VMSA-2016-0014)	Nessus	Windows	high
93512	VMSA-2016-0014 : VMware ESXi, Workstation, Fusion, & Tools updates address multiple security issues	Nessus	VMware ESX Local Security Checks	high

Detections

Analytics

CVE-2016-7083

high

Tenable Plugins

high

high