VMware ESXi (ESXi 6.5 without patch ESXi650-201707101-SG), Workstation (12.x before 12.5.7) and Fusion (8.x before 8.5.8) contain an out-of-bounds write vulnerability in SVGA device. This issue may allow a guest to execute code on the host.

The version of VMware Workstation installed on the remote Windows host is 12.x prior to 12.5.7. It is, therefore, affected by the following vulnerabilities:

  - A remote code execution vulnerability exists in VMware     workstation within the SVGA device. An attacker with     user access can exploit this to execute arbitrary     code. (CVE-2017-4924)

  - A denial of service vulnerability exists in VMware     workstation due to a NULL pointer deference when     handling guest RPC requests. An attacker with guest     access can exploit this to crash their VMs.
    NOTE: This vulnerability only affects VMware     Workstation 12.5.2 and below. (CVE-2017-4925)

The version of VMware Workstation installed on the remote Linux host is 12.x prior to 12.5.7. It is, therefore, affected by the following vulnerabilities:

  - A remote code execution vulnerability exists in VMware     workstation within the SVGA device. An attacker with     user access can exploit this to execute arbitrary     code. (CVE-2017-4924)

  - A denial of service vulnerability exists in VMware     workstation due to a NULL pointer deference when     handling guest RPC requests. An attacker with guest     access can exploit this to crash their VMs.
    NOTE: This vulnerability only affects VMware     Workstation 12.5.2 and below. (CVE-2017-4925)

The version of the remote VMware ESXi 6.5 host is prior to build 5969300. It is, therefore, affected by multiple vulnerabilities :

  - An out-of-bounds write error related to SVGA devices     that allows a guest virtual machine to execute code on     the host machine. (CVE-2017-4924)

  - A NULL pointer dereference vulnerability related to     handling RPC requests that could allow an     attacker to crash a virtual machine. (CVE-2017-4925)

The version of VMware Fusion installed on the remote macOS or Mac OS X host is 8.x prior to 8.5.8. It is, therefore, affected by an out-of- bounds write error related to SVGA devices that allows a guest virtual machine to execute code on the host.

a. Out-of-bounds write vulnerability in SVGA

VMware ESXi, Workstation and Fusion contain an out-of-bounds write vulnerability in SVGA device. This issue may allow a guest to execute code on the host.

VMware would like to thank Nico Golde and Ralf-Philipp Weinmann of Comsecuris UG (haftungsbeschraenkt) working with ZDI for reporting this issue to us.

The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the identifier CVE-2017-4924 to this issue.

b. Guest RPC NULL pointer dereference vulnerability

VMware ESXi, Workstation and Fusion contain a NULL pointer dereference vulnerability. This issue occurs when handling guest RPC requests.
Successful exploitation of this issue may allow attackers with normal user privileges to crash their VMs.

VMware would like to thank Zhang Haitao for reporting this issue to us.

The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the identifier CVE-2017-4925 to this issue.

c. Stored XSS in H5 Client

vCenter Server H5 Client contains a vulnerability that may allow for stored cross-site scripting (XSS). An attacker with VC user privileges can inject malicious java-scripts which will get executed when other VC users access the page.

VMware would like to thank Thomas Ornetzeder for reporting this issue to us.

The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the identifier CVE-2017-4926 to this issue.

ID	Name	Product	Family	Severity
103380	VMware Workstation 12.x < 12.5.7 Multiple Vulnerabilities (VMSA-2017-0015)	Nessus	Windows	high
103379	VMware Workstation 12.x < 12.5.7 Multiple Vulnerabilities (VMSA-2017-0015) (Linux)	Nessus	General	high
103376	ESXi 6.5 < Build 5969300 Multiple Vulnerabilities (VMSA-2017-0015) (remote check)	Nessus	Misc.	high
103374	VMware Fusion 8.x < 8.5.8 SVGA Code Execution Vulnerability (VMSA-2017-0015) (macOS)	Nessus	MacOS X Local Security Checks	high
103357	VMSA-2017-0015 : VMware ESXi, vCenter Server, Fusion and Workstation updates resolve multiple security vulnerabilities	Nessus	VMware ESX Local Security Checks	high

Detections

Analytics

CVE-2017-4924

high

Tenable Plugins

high

high

high

high

high