CVE-2016-7085: High severity vmware workstation and esxi vulnerability
Published Dec 29, 2016
·Updated
Untrusted search path vulnerability in the installer in VMware Workstation Pro 12.x before 12.5.0 and VMware Workstation Player 12.x before 12.5.0 on Windows allows local users to gain privileges via a Trojan horse DLL in an unspecified directory.
Affected Software
9 affected components
VMware Workstation Player=12.0.0
VMware Workstation Player=12.0.1
VMware Workstation Player=12.1.0
VMware Workstation Player=12.1.1
VMware Workstation Pro=12.0.0
VMware Workstation Pro=12.0.1
VMware Workstation Pro=12.1.0
VMware Workstation Pro=12.1.1
Microsoft Windows
Event History
Dec 29, 2016
CVE Published
via MITRE·09:02 AM
Data Sourced
via MITRE·09:02 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2016-7085?
CVE-2016-7085 is classified as a privilege escalation vulnerability.
2
How do I fix CVE-2016-7085?
To fix CVE-2016-7085, upgrade to VMware Workstation Pro or Player version 12.5.0 or later.
3
Who is affected by CVE-2016-7085?
CVE-2016-7085 affects local users on Windows systems with vulnerable versions of VMware Workstation Pro and Player.
4
What causes CVE-2016-7085?
CVE-2016-7085 is caused by an untrusted search path in the installer that allows loading of malicious DLLs.
5
Can CVE-2016-7085 be exploited remotely?
CVE-2016-7085 cannot be exploited remotely; it requires local access to the system.