CVE-2017-4949: Use After Free
First published: Thu Jan 11 2018(Updated: )
VMware Workstation and Fusion contain a use-after-free vulnerability in VMware NAT service when IPv6 mode is enabled. This issue may allow a guest to execute code on the host. Note: IPv6 mode for VMNAT is not enabled by default.
Credit: security@vmware.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| VMware Fusion Pro | >=8.0<8.5.10 | |
| VMware Fusion Pro | >=10.0<10.1.1 | |
| macOS Yosemite | ||
| VMware Workstation | >=12.0<12.5.9 | |
| VMware Workstation | >=14.0<14.1.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2017-4949?
CVE-2017-4949 is rated as a critical severity vulnerability due to its potential to allow guest code execution on the host.
How do I fix CVE-2017-4949?
To fix CVE-2017-4949, users should update to the latest patched version of VMware Workstation or Fusion that resolves this vulnerability.
Which versions of VMware are affected by CVE-2017-4949?
CVE-2017-4949 affects VMware Workstation versions 12.0 to 12.5.9 and 14.0 to 14.1.1, as well as VMware Fusion versions 8.0 to 8.5.10 and 10.0 to 10.1.1.
Is IPv6 mode enabled by default in VMware NAT services?
No, in VMware NAT services, IPv6 mode is not enabled by default, which mitigates the exploit risk unless enabled by the user.
Can CVE-2017-4949 impact macOS systems?
CVE-2017-4949 pertains to VMware products and is not directly applicable to macOS systems; however, affected VMware software running on macOS is vulnerable.
- agent/type
- agent/severity
- agent/weakness
- agent/remedy
- agent/author
- agent/references
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- agent/first-publish-date
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/vmware
- canonical/vmware fusion pro
- version/vmware fusion pro/8.0
- version/vmware fusion pro/10.0
- vendor/apple
- canonical/macos yosemite
- canonical/vmware workstation
- version/vmware workstation/12.0
- version/vmware workstation/14.0