VulnerabilityModified

CVE-2009-0199

HIGH 9.3EPSS 5.02%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (5.02%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Heap-based buffer overflow in the VMnc media codec in vmnc.dll in VMware Movie Decoder before 6.5.3 build 185404, VMware Workstation 6.5.x before 6.5.3 build 185404, VMware Player 2.5.x before 2.5.3 build 185404, and VMware ACE 2.5.x before 2.5.3 build 185404 on Windows might allow remote attackers to execute arbitrary code via a video file with crafted dimensions (aka framebuffer parameters).

CVSS 2.0: 9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C
EPSS: 5.02% probability · 92th percentile
CISA KEV: Not listed
Weakness: CWE-119
Affected: vmware/ace · vmware/movie decoder · vmware/player · vmware/workstation
Source: PSIRT-CNA@flexerasoftware.com

References

http://lists.vmware.com/pipermail/security-announce/2009/000065.htmlPatch
http://secunia.com/advisories/34938Vendor Advisory
http://secunia.com/secunia_research/2009-25/Vendor Advisory
http://www.securityfocus.com/archive/1/506286/100/0/threaded
http://www.securityfocus.com/bid/36290
http://www.vmware.com/security/advisories/VMSA-2009-0012.htmlPatch, Vendor Advisory
http://www.vupen.com/english/advisories/2009/2553Patch, Vendor Advisory
http://lists.vmware.com/pipermail/security-announce/2009/000065.htmlPatch
http://secunia.com/advisories/34938Vendor Advisory
http://secunia.com/secunia_research/2009-25/Vendor Advisory
http://www.securityfocus.com/archive/1/506286/100/0/threaded
http://www.securityfocus.com/bid/36290
http://www.vmware.com/security/advisories/VMSA-2009-0012.htmlPatch, Vendor Advisory
http://www.vupen.com/english/advisories/2009/2553Patch, Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.