Out-of-bounds write in VMware, Inc products - CVE-2017-4924

Vulnerability identifier: #VU8443

CSH Severity: Low

CVSS v4: 8.7 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-4924

CWE-ID: CWE-787

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows an adjacent attacker to execute arbitrary code.

The weakness exists due to out-of-bounds write in SVGA driver. An adjacent attacker can send specially crafted content and execute arbitrary code on the host system.

VMware ESXi
VMware Fusion
VMware Workstation

Install update from vendor's website.

• https://www.vmware.com/security/advisories/VMSA-2017-0015.html

• Multiple vulnerabilities in VmWare products