CVE-2017-4949: Use After Free
VMware Workstation and Fusion contain a use-after-free vulnerability in VMware NAT service when IPv6 mode is enabled. This issue may allow a guest to execute code on the host. Note: IPv6 mode for VMNAT is not enabled by default.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2017-4949?
CVE-2017-4949 is rated as a critical severity vulnerability due to its potential to allow guest code execution on the host.
How do I fix CVE-2017-4949?
To fix CVE-2017-4949, users should update to the latest patched version of VMware Workstation or Fusion that resolves this vulnerability.
Which versions of VMware are affected by CVE-2017-4949?
CVE-2017-4949 affects VMware Workstation versions 12.0 to 12.5.9 and 14.0 to 14.1.1, as well as VMware Fusion versions 8.0 to 8.5.10 and 10.0 to 10.1.1.
Is IPv6 mode enabled by default in VMware NAT services?
No, in VMware NAT services, IPv6 mode is not enabled by default, which mitigates the exploit risk unless enabled by the user.
Can CVE-2017-4949 impact macOS systems?
CVE-2017-4949 pertains to VMware products and is not directly applicable to macOS systems; however, affected VMware software running on macOS is vulnerable.