CVE-2016-7461: Buffer Overflow
First published: Thu Dec 29 2016(Updated: )
The drag-and-drop (aka DnD) function in VMware Workstation Pro 12.x before 12.5.2 and VMware Workstation Player 12.x before 12.5.2 and VMware Fusion and Fusion Pro 8.x before 8.5.2 allows guest OS users to execute arbitrary code on the host OS or cause a denial of service (out-of-bounds memory access on the host OS) via unspecified vectors.
Credit: security@vmware.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| VMware Fusion Pro | =8.0.0 | |
| VMware Fusion Pro | =8.0.1 | |
| VMware Fusion Pro | =8.0.2 | |
| VMware Fusion Pro | =8.1.0 | |
| VMware Fusion Pro | =8.1.1 | |
| VMware Fusion Pro | =8.5.0 | |
| VMware Fusion Pro | =8.5.1 | |
| VMware Fusion Pro | =8.0.0 | |
| VMware Fusion Pro | =8.0.1 | |
| VMware Fusion Pro | =8.0.2 | |
| VMware Fusion Pro | =8.1.0 | |
| VMware Fusion Pro | =8.1.1 | |
| VMware Fusion Pro | =8.5.0 | |
| VMware Fusion Pro | =8.5.1 | |
| VMware Workstation Player | =12.0.0 | |
| VMware Workstation Player | =12.0.1 | |
| VMware Workstation Player | =12.1.0 | |
| VMware Workstation Player | =12.1.1 | |
| VMware Workstation Player | =12.5.0 | |
| VMware Workstation Player | =12.5.1 | |
| VMware Workstation Pro | =12.0.0 | |
| VMware Workstation Pro | =12.0.1 | |
| VMware Workstation Pro | =12.1.0 | |
| VMware Workstation Pro | =12.1.1 | |
| VMware Workstation Pro | =12.5.0 | |
| VMware Workstation Pro | =12.5.1 | |
| Microsoft Windows |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2016-7461?
CVE-2016-7461 has a critical severity level due to its potential to allow arbitrary code execution on the host OS.
How do I fix CVE-2016-7461?
To address CVE-2016-7461, users should upgrade to VMware Workstation Pro 12.5.2, Workstation Player 12.5.2, or Fusion and Fusion Pro 8.5.2 or later.
Which VMware products are affected by CVE-2016-7461?
CVE-2016-7461 affects VMware Workstation Pro and Player versions 12.x before 12.5.2, and Fusion and Fusion Pro versions 8.x before 8.5.2.
What type of attack does CVE-2016-7461 facilitate?
CVE-2016-7461 can be exploited to execute arbitrary code on the host OS or to cause a denial of service.
Can guest OS users exploit CVE-2016-7461?
Yes, guest OS users can exploit CVE-2016-7461 to perform unauthorized actions on the host operating system.
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/severity
- agent/references
- agent/weakness
- agent/last-modified-date
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/vmware
- canonical/vmware fusion pro
- version/vmware fusion pro/8.0.0
- version/vmware fusion pro/8.0.1
- version/vmware fusion pro/8.0.2
- version/vmware fusion pro/8.1.0
- version/vmware fusion pro/8.1.1
- version/vmware fusion pro/8.5.0
- version/vmware fusion pro/8.5.1
- canonical/vmware workstation player
- version/vmware workstation player/12.0.0
- version/vmware workstation player/12.0.1
- version/vmware workstation player/12.1.0
- version/vmware workstation player/12.1.1
- version/vmware workstation player/12.5.0
- version/vmware workstation player/12.5.1
- canonical/vmware workstation pro
- version/vmware workstation pro/12.0.0
- version/vmware workstation pro/12.0.1
- version/vmware workstation pro/12.1.0
- version/vmware workstation pro/12.1.1
- version/vmware workstation pro/12.5.0
- version/vmware workstation pro/12.5.1
- vendor/microsoft
- canonical/microsoft windows