Out-of-bounds read in VMware Horizon and VMware Workstation - CVE-2017-4937
Published: November 20, 2017
Vulnerability identifier: #VU9358
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-4937
CWE-ID: CWE-125
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an adjacent attacker to cause DoS condtition on the target system.
The weakness exists due to out-of-bounds memory read error in JPEG2000 parser in the TPView.dll. An adjacent attacker can trigger memory corruption and cause the service to crash.
The weakness exists due to out-of-bounds memory read error in JPEG2000 parser in the TPView.dll. An adjacent attacker can trigger memory corruption and cause the service to crash.
Affected software
VMware Horizon
VMware Workstation
VMware Workstation
How to mitigate CVE-2017-4937
Update Workstation to version 12.5.8.
Update Horizon View Client for Windows to version 4.6.1.
Update Horizon View Client for Windows to version 4.6.1.