CVE-2012-2449

VMware Workstation/Player/Fusion/ESXi/ESX - DoS or Code Execution via Virtual Floppy Device

Title source: llm
STIX 2.1

Description

VMware Workstation 8.x before 8.0.3, VMware Player 4.x before 4.0.3, VMware Fusion 4.x through 4.1.2, VMware ESXi 3.5 through 5.0, and VMware ESX 3.5 through 4.1 do not properly configure the virtual floppy device, which allows guest OS users to cause a denial of service (out-of-bounds write operation and VMX process crash) or possibly execute arbitrary code on the host OS by leveraging administrative privileges on the guest OS.

References (7)

Core 7
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://osvdb.org/81694
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16863
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/49032
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/53369
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/75376
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id?1027019

Scores

EPSS 0.0204
EPSS Percentile 84.1%

Details

CWE
CWE-119
Status published
Products (19)
vmware/esx 3.5 (4 CPE variants)
vmware/esx 4.0
vmware/esx 4.1
vmware/esxi 3.5 (2 CPE variants)
vmware/esxi 4.0 (5 CPE variants)
vmware/esxi 4.1 (3 CPE variants)
vmware/esxi 5.0
vmware/fusion 4.0
vmware/fusion 4.0.1
vmware/fusion 4.0.2
... and 9 more
Published May 04, 2012
Tracked Since Feb 18, 2026