CVE-2017-4904
High
Description
The XHCI controller in VMware ESXi 6.5 without patch ESXi650-201703410-SG, 6.0 U3 without patch ESXi600-201703401-SG, 6.0 U2 without patch ESXi600-201703403-SG, 6.0 U1 without patch ESXi600-201703402-SG, and 5.5 without patch ESXi550-201703401-SG; Workstation Pro / Player 12.x prior to 12.5.5; and Fusion Pro / Fusion 8.x prior to 8.5.6 has uninitialized memory usage. This issue may allow a guest to execute code on the host. The issue is reduced to a Denial of Service of the guest on ESXi 5.5.
SeverityHigh
CVSS8.8
Exploit probability—
Product
Vmware Fusion
PublishedJun 7, 2017
First seenJun 7, 2017
How to fix
Update
- vmware fusion8.5.6 or later
- vmware fusion_pro8.5.6 or later
- vmware workstation_player12.5.5 or later
- vmware workstation_pro12.5.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| vmware fusion | 8.0.0 ≤ v < 8.5.6 | 8.5.6 |
| vmware fusion_pro | 8.0.0 ≤ v < 8.5.6 | 8.5.6 |
| vmware workstation_player | 12.0.0 ≤ v < 12.5.5 | 12.5.5 |
| vmware workstation_pro | 12.0.0 ≤ v < 12.5.5 | 12.5.5 |
| vmware esxi | 5.5, 6.0, 6.5 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.