CVE-2009-2628

Published: Sep 8, 2009Modified: Apr 23, 2026

9.3

Vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability: 8.6 / Impact: 10.0

Source: NVD

Description

The VMnc media codec in vmnc.dll in VMware Movie Decoder before 6.5.3 build 185404, VMware Workstation 6.5.x before 6.5.3 build 185404, VMware Player 2.5.x before 2.5.3 build 185404, and VMware ACE 2.5.x before 2.5.3 build 185404 on Windows does not properly handle certain small heights in video content, which might allow remote attackers to execute arbitrary code via a crafted AVI file that triggers heap memory corruption.

Affected (11)

Products: Vmware: Ace, Movie Decoder, Player, Workstation

4 products

Configuration A

11 vulnerable

Vulnerable Software	Affected Versions
Vmware Ace	Version 2.5.0
Vmware Ace	Version 2.5.1
Vmware Ace	Version 2.5.2
Vmware Movie Decoder	Version 6.5.3
Vmware Player	Version 2.5.1
Vmware Player	Version 2.5.2
Vmware Player	Version 2.5
Vmware Workstation	Version 6.5.0
Vmware Workstation	Version 6.5.1
Vmware Workstation	Version 6.5.2
Vmware Workstation	Version 6.5

Related CWEs

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (14)

http://lists.vmware.com/pipermail/security-announce/2009/000065.html

Source: cret@cert.org

Patch

http://secunia.com/advisories/34938

Source: cret@cert.org

Vendor Advisory

http://www.kb.cert.org/vuls/id/444513

Source: cret@cert.org

US Government Resource

http://www.securityfocus.com/archive/1/506286/100/0/threaded

Source: cret@cert.org

http://www.securityfocus.com/bid/36290

Source: cret@cert.org

Patch

http://www.vmware.com/security/advisories/VMSA-2009-0012.html

Source: cret@cert.org

PatchVendor Advisory

http://www.vupen.com/english/advisories/2009/2553

Source: cret@cert.org

Vendor Advisory

http://lists.vmware.com/pipermail/security-announce/2009/000065.html

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://secunia.com/advisories/34938

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.kb.cert.org/vuls/id/444513

Source: af854a3a-2127-422b-91ae-364da2661108

US Government Resource

http://www.securityfocus.com/archive/1/506286/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/36290

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://www.vmware.com/security/advisories/VMSA-2009-0012.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

http://www.vupen.com/english/advisories/2009/2553

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.