CVE-2010-4294

VMware Movie Decoder < 6.5.5 - Remote Code Execution via Crafted Video File

Title source: llm
STIX 2.1

Description

The frame decompression functionality in the VMnc media codec in VMware Movie Decoder before 6.5.5 build 328052 and 7.x before 7.1.2 build 301548, VMware Workstation 6.5.x before 6.5.5 build 328052 and 7.x before 7.1.2 build 301548 on Windows, VMware Player 2.5.x before 2.5.5 build 246459 and 3.x before 3.1.2 build 301548 on Windows, and VMware Server 2.x on Windows does not properly validate an unspecified size field, which allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a crafted video file.

References (8)

Core 8
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id?1024819
Vendor Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2010/3116
Various Sources mailing-list x_refsource_mlist
http://lists.vmware.com/pipermail/security-announce/2010/000112.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/45169
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/514995/100/0/threaded
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://osvdb.org/69596
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/42482

Scores

EPSS 0.0607
EPSS Percentile 90.9%

Details

CWE
CWE-94
Status published
Products (30)
vmware/movie_decoder 6.5.3
vmware/movie_decoder 6.5.4
vmware/movie_decoder 7.0
vmware/movie_decoder 7.1.2
vmware/movie_decoder < 6.5.5
vmware/player 2.5
vmware/player 2.5.1
vmware/player 2.5.2
vmware/player 2.5.3
vmware/player 2.5.4
... and 20 more
Published Dec 06, 2010
Tracked Since Feb 18, 2026