VulnerabilityModified

CVE-2009-2628

HIGH 9.3EPSS 5.57%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (5.57%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

The VMnc media codec in vmnc.dll in VMware Movie Decoder before 6.5.3 build 185404, VMware Workstation 6.5.x before 6.5.3 build 185404, VMware Player 2.5.x before 2.5.3 build 185404, and VMware ACE 2.5.x before 2.5.3 build 185404 on Windows does not properly handle certain small heights in video content, which might allow remote attackers to execute arbitrary code via a crafted AVI file that triggers heap memory corruption.

CVSS 2.0: 9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C
EPSS: 5.57% probability · 92th percentile
CISA KEV: Not listed
Weakness: CWE-94
Affected: vmware/ace · vmware/movie decoder · vmware/player · vmware/workstation
Source: cret@cert.org

References

http://lists.vmware.com/pipermail/security-announce/2009/000065.htmlPatch
http://secunia.com/advisories/34938Vendor Advisory
http://www.kb.cert.org/vuls/id/444513US Government Resource
http://www.securityfocus.com/archive/1/506286/100/0/threaded
http://www.securityfocus.com/bid/36290Patch
http://www.vmware.com/security/advisories/VMSA-2009-0012.htmlPatch, Vendor Advisory
http://www.vupen.com/english/advisories/2009/2553Vendor Advisory
http://lists.vmware.com/pipermail/security-announce/2009/000065.htmlPatch
http://secunia.com/advisories/34938Vendor Advisory
http://www.kb.cert.org/vuls/id/444513US Government Resource
http://www.securityfocus.com/archive/1/506286/100/0/threaded
http://www.securityfocus.com/bid/36290Patch
http://www.vmware.com/security/advisories/VMSA-2009-0012.htmlPatch, Vendor Advisory
http://www.vupen.com/english/advisories/2009/2553Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.