9.3

CVE-2009-2628

The VMnc media codec in vmnc.dll in VMware Movie Decoder before 6.5.3 build 185404, VMware Workstation 6.5.x before 6.5.3 build 185404, VMware Player 2.5.x before 2.5.3 build 185404, and VMware ACE 2.5.x before 2.5.3 build 185404 on Windows does not properly handle certain small heights in video content, which might allow remote attackers to execute arbitrary code via a crafted AVI file that triggers heap memory corruption.

Data is provided by the National Vulnerability Database (NVD)
VMware ≫ Ace Version2.5.0
VMware ≫ Ace Version2.5.1
VMware ≫ Ace Version2.5.2
VMware ≫ Movie Decoder Version6.5.3
VMware ≫ Player Version2.5
VMware ≫ Player Version2.5.1
VMware ≫ Player Version2.5.2
VMware ≫ Workstation Version6.5
VMware ≫ Workstation Version6.5.0
VMware ≫ Workstation Version6.5.1
VMware ≫ Workstation Version6.5.2
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 11.76% 0.93
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 9.3 8.6 10
AV:N/AC:M/Au:N/C:C/I:C/A:C
CWE-94 Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.