CVE-2009-0910

VMware ACE, Player, Server, and Workstation - Heap-Based Buffer Overflow in VNnc Codec

Title source: llm
STIX 2.1

Description

Heap-based buffer overflow in the VNnc Codec in VMware Workstation 6.5.x before 6.5.2 build 156735, VMware Player 2.5.x before 2.5.2 build 156735, VMware ACE 2.5.x before 2.5.2 build 156735, and VMware Server 2.0.x before 2.0.1 build 156745 allows remote attackers to execute arbitrary code via a crafted web page or video file, aka ZDI-CAN-436.

References (8)

Core 8
Core References
Third Party Advisory vendor-advisory x_refsource_gentoo
http://security.gentoo.org/glsa/glsa-201209-25.xml
Patch mailing-list x_refsource_fulldisc
http://seclists.org/fulldisclosure/2009/Apr/0036.html
Exploit vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/34373
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2009/0944
Patch, Vendor Advisory mailing-list x_refsource_mlist
http://lists.vmware.com/pipermail/security-announce/2009/000054.html
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5786
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id?1021974

Scores

EPSS 0.0440
EPSS Percentile 89.1%

Details

CWE
CWE-119
Status published
Products (4)
vmware/ace 2.5.1
vmware/player 2.5.1
vmware/server 2.0
vmware/workstation 6.5.1
Published Apr 06, 2009
Tracked Since Feb 18, 2026