CVE-2010-1139
High
Description
Format string vulnerability in vmrun in VMware VIX API 1.6.x, VMware Workstation 6.5.x before 6.5.4 build 246459, VMware Player 2.5.x before 2.5.4 build 246459, and VMware Server 2.x on Linux, and VMware Fusion 2.x before 2.0.7 build 246742, allows local users to gain privileges via format string specifiers in process metadata.
SeverityHigh
CVSS7.2
Exploit probability—
Product
Vmware Workstation
PublishedApr 12, 2010
First seenApr 12, 2010
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| vmware workstation | 6.5.0, 6.5.1, 6.5.2, 6.5.3 | — |
| vmware player | 2.5, 2.5.1, 2.5.2, 2.5.3 | — |
| vmware server | 2.0.0, 2.0.1, 2.0.2 | — |
| vmware fusion | 2.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, 2.0.6 | — |
| vmware vix_api | 1.6.0, 1.6.1 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.