CVE-2017-4948: Infoleak
First published: Thu Jan 04 2018(Updated: )
VMware Workstation (14.x before 14.1.0 and 12.x) and Horizon View Client (4.x before 4.7.0) contain an out-of-bounds read vulnerability in TPView.dll. On Workstation, this issue in conjunction with other bugs may allow a guest to leak information from host or may allow for a Denial of Service on the Windows OS that runs Workstation. In the case of a Horizon View Client, this issue in conjunction with other bugs may allow a View desktop to leak information from host or may allow for a Denial of Service on the Windows OS that runs the Horizon View Client. Exploitation is only possible if virtual printing has been enabled. This feature is not enabled by default on Workstation but it is enabled by default on Horizon View.
Credit: security@vmware.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| VMware Workstation | =12.0.0 | |
| VMware Workstation | =12.0.1 | |
| VMware Workstation | =12.1 | |
| VMware Workstation | =12.1.1 | |
| VMware Workstation | =12.5 | |
| VMware Workstation | =12.5.0 | |
| VMware Workstation | =12.5.1 | |
| VMware Workstation | =12.5.2 | |
| VMware Workstation | =12.5.3 | |
| VMware Workstation | =12.5.4 | |
| VMware Workstation | =12.5.5 | |
| VMware Workstation | =12.5.6 | |
| VMware Workstation | =12.5.7 | |
| VMware Workstation | =12.5.8 | |
| VMware Workstation | =12.5.9 | |
| VMware Workstation | =14.0 | |
| VMware Horizon View | >=4.0<4.7 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2017-4948?
CVE-2017-4948 is a vulnerability in VMware Workstation (14.x before 14.1.0 and 12.x) and Horizon View Client (4.x before 4.7.0) that allows a guest to leak information from the host or to cause a Denial of Service.
How severe is CVE-2017-4948?
CVE-2017-4948 has a severity rating of 7.1, indicating a high severity.
How can I fix CVE-2017-4948?
To fix CVE-2017-4948, update VMware Workstation to version 14.1.0 or later, or update Horizon View Client to version 4.7.0 or later.
What is TPView.dll?
TPView.dll is a dynamic link library file associated with VMware Workstation and Horizon View Client.
Are there any known exploits or incidents related to CVE-2017-4948?
There are no known exploits or incidents related to CVE-2017-4948 at this time.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/weakness
- agent/remedy
- agent/last-modified-date
- agent/author
- agent/references
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- vendor/vmware
- canonical/vmware workstation
- version/vmware workstation/12.0.0
- version/vmware workstation/12.0.1
- version/vmware workstation/12.1
- version/vmware workstation/12.1.1
- version/vmware workstation/12.5
- version/vmware workstation/12.5.0
- version/vmware workstation/12.5.1
- version/vmware workstation/12.5.2
- version/vmware workstation/12.5.3
- version/vmware workstation/12.5.4
- version/vmware workstation/12.5.5
- version/vmware workstation/12.5.6
- version/vmware workstation/12.5.7
- version/vmware workstation/12.5.8
- version/vmware workstation/12.5.9
- version/vmware workstation/14.0
- canonical/vmware horizon view
- version/vmware horizon view/4.0