VMware Workstation and Fusion contain a use-after-free vulnerability in VMware NAT service when IPv6 mode is enabled. This issue may allow a guest to execute code on the host. Note: IPv6 mode for VMNAT is not enabled by default.

The version of VMware Workstation installed on the remote Windows host is 14.x prior to 14.1.1 or 12.x prior to 12.5.9. It is, therefore, missing security updates that add hypervisor-assisted guest remediation for a speculative execution vulnerability (CVE-2017-5715). These updates will allow guest operating systems to use hardware support for branch target mitigation and will require guest OS security updates as detailed in VMware Knowledge Base article 52085.
It is also affected by use-after-free and integer-overflow vulnerabilities.

Note that hypervisor-specific remediation's for this vulnerability were released as part of VMSA-2018-0002.

The version of VMware Player installed on the remote Windows host is 14.x prior to 14.1.1 or 12.x prior to 12.5.9. It is, therefore, missing security updates that add hypervisor-assisted guest remediation for a speculative execution vulnerability (CVE-2017-5715). These updates will allow guest operating systems to use hardware support for branch target mitigation and require guest OS security updates as detailed in VMware Knowledge Base article 52085.
It is also affected by use-after-free and integer-overflow vulnerabilities.

Note that hypervisor-specific remediation's for this vulnerability were released as part of VMSA-2018-0002.

The version of VMware Fusion installed on the remote macOS or Mac OS X host is 8.x prior to 8.5.10 or 10.x prior to 10.1.1. It is, therefore, missing security updates that add hypervisor-assisted guest remediation for a speculative execution vulnerability (CVE-2017-5715). These updates will allow guest operating systems to use hardware support for branch target mitigation and will require guest OS security updates as detailed in VMware Knowledge Base article 52085.
It is also affected by use-after-free and integer-overflow vulnerabilities.

Note that hypervisor-specific remediation's for this vulnerability were released as part of VMSA-2018-0002.

ID	Name	Product	Family	Severity
105785	VMware Workstation 12.x < 12.5.9 / 14.x < 14.1.1 Multiple Vulnerabilities (VMSA-2018-0004) (VMSA-2018-0005) (Spectre)	Nessus	Windows	high
105783	VMware Player 12.x < 12.5.9 / 14.x < 14.1.1 Multiple Vulnerabilities (VMSA-2018-0004) (VMSA-2018-0005) (Spectre)	Nessus	Windows	high
105781	VMware Fusion 8.x < 8.5.10 / 10.x < 10.1.1 Multiple Vulnerabilities (VMSA-2018-0004) (VMSA-2018-0005) (Spectre) (macOS)	Nessus	MacOS X Local Security Checks	high

Detections

Analytics

CVE-2017-4949

high

Tenable Plugins

high

high

high