CVE-2017-4933
At a glance Severity Not available EPSS EPSS 3.57 % · percentile 89 (2026-10-27) State PUBLISHED Published 2017-12-20 Updated 2024-09-16 Assigner vmware NVD status Modified Description VMware ESXi (6.5 before ESXi650-201710401-BG), Workstation (12.x before 12.5.8), and Fusion (8.x before 8.5.9) contain a vulnerability that could allow an authenticated VNC session to cause a heap overflow via a specific set of VNC packets resulting in heap corruption. Successful exploitation of this issue could result in remote code execution in a virtual machine via the authenticated VNC session. Note: In order for exploitation to be possible in ESXi, VNC must be manually enabled in a virtual machine's .vmx configuration file. In addition, ESXi must be configured to allow VNC traffic through the built-in firewall.
Scores Version Score Vector Scored by CVSS 3.1 HIGH 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H NVD · nvd@nist.gov (Primary) CVSS 2.0 MEDIUM 6.0 AV:N/AC:M/Au:S/C:P/I:P/A:P NVD · nvd@nist.gov (Primary)
Weaknesses (CWE)
European references
CERT-FR advisories
Affected configurations (NVD CPE) cpe:2.3:a:vmware:workstation_pro:*:*:*:*:*:*:*:* ≥ 12.0.0 < 12.5.8cpe:2.3:a:vmware:workstation_pro:14.0:*:*:*:*:*:*:*cpe:2.3:a:vmware:workstation_pro:14.1.0:*:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.5:-:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.5:650-201701001:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.5:650-201703001:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.5:650-201703002:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.5:650-201704001:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.5:650-201707101:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.5:650-201707102:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.5:650-201707103:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.5:650-201707201:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.5:650-201707202:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.5:650-201707203:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.5:650-201707204:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.5:650-201707205:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.5:650-201707206:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.5:650-201707207:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.5:650-201707208:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.5:650-201707209:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.5:650-201707210:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.5:650-201707211:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.5:650-201707212:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.5:650-201707213:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.5:650-201707214:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.5:650-201707215:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.5:650-201707216:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.5:650-201707217:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.5:650-201707218:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.5:650-201707219:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.5:650-201707220:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.5:650-201707221:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:6.5:650-201710001:*:*:*:*:*:*cpe:2.3:a:vmware:fusion:*:*:*:*:*:*:*:* ≥ 8.0.0 < 8.5.9Affected products
References
Sources
