CVE-2010-4297: Input Validation
The VMware Tools update functionality in VMware Workstation 6.5.x before 6.5.5 build 328052 and 7.x before 7.1.2 build 301548; VMware Player 2.5.x before 2.5.5 build 328052 and 3.1.x before 3.1.2 build 301548; VMware Server 2.0.2; VMware Fusion 2.x before 2.0.8 build 328035 and 3.1.x before 3.1.2 build 332101; VMware ESXi 3.5, 4.0, and 4.1; and VMware ESX 3.0.3, 3.5, 4.0, and 4.1 allows host OS users to gain privileges on the guest OS via unspecified vectors, related to a "command injection" issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2010-4297?
CVE-2010-4297 has a medium severity rating, impacting the update functionality of various VMware products.
How do I fix CVE-2010-4297?
To fix CVE-2010-4297, upgrade your VMware product to the latest version that is not affected, such as VMware Workstation 6.5.5 or VMware Player 2.5.5.
What VMware products are affected by CVE-2010-4297?
CVE-2010-4297 affects VMware Workstation 6.5.x through 7.x, VMware Player 2.5.x through 3.1.x, and VMware Fusion 2.x through 3.1.x.
What vulnerabilities does CVE-2010-4297 introduce?
CVE-2010-4297 can potentially allow unauthorized access to malicious users due to flaws in the update process.
When was CVE-2010-4297 published?
CVE-2010-4297 was published on December 15, 2010.