7

CVE-2017-4949

VMware Workstation and Fusion contain a use-after-free vulnerability in VMware NAT service when IPv6 mode is enabled. This issue may allow a guest to execute code on the host. Note: IPv6 mode for VMNAT is not enabled by default.

Data is provided by the National Vulnerability Database (NVD)
VMware ≫ Fusion Version >= 8.0 < 8.5.10
   Apple ≫ macOS X Version-
VMware ≫ Fusion Version >= 10.0 < 10.1.1
   Apple ≫ macOS X Version-
VMware ≫ Workstation Version >= 12.0 < 12.5.9
VMware ≫ Workstation Version >= 14.0 < 14.1.1
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.07% 0.186
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 7 1 5.9
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 6.9 3.4 10
AV:L/AC:M/Au:N/C:C/I:C/A:C
CWE-416 Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

http://www.securityfocus.com/bid/102489
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1040161
Third Party Advisory
VDB Entry