← Back

CVE-2010-4297

nvd nist
Published: Dec 6, 2010Modified: Apr 29, 2026

JSON object

Loading...
7.2
Vector
AV:L/AC:L/Au:N/C:C/I:C/A:C
Exploitability: 3.9 / Impact: 10.0
Source: NVD

Description

The VMware Tools update functionality in VMware Workstation 6.5.x before 6.5.5 build 328052 and 7.x before 7.1.2 build 301548; VMware Player 2.5.x before 2.5.5 build 328052 and 3.1.x before 3.1.2 build 301548; VMware Server 2.0.2; VMware Fusion 2.x before 2.0.8 build 328035 and 3.1.x before 3.1.2 build 332101; VMware ESXi 3.5, 4.0, and 4.1; and VMware ESX 3.0.3, 3.5, 4.0, and 4.1 allows host OS users to gain privileges on the guest OS via unspecified vectors, related to a "command injection" issue.

Affected (37)

Vmware
5 products
Workstation
Player
Fusion
Esxi
Esx
Configuration A
10 vulnerable
Vulnerable SoftwareAffected Versions
Vmware
Workstation
Version 6.5.0
Workstation
Version 6.5.1
Workstation
Version 6.5.2
Workstation
Version 6.5.3
Workstation
Version 6.5.5
Workstation
Version 7.0.1
Workstation
Version 7.0
Workstation
Version 7.1.1
Workstation
Version 7.1.2
Workstation
Version 7.1
Configuration B
9 vulnerable
Vulnerable SoftwareAffected Versions
Vmware
Player
Version 2.5.1
Player
Version 2.5.2
Player
Version 2.5.3
Player
Version 2.5.4
Player
Version 2.5.5
Player
Version 2.5
Player
Version 3.1.1
Player
Version 3.1.2
Player
Version 3.1
Configuration C
12 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Vmware
Fusion
Version 2.0.1
Fusion
Version 2.0.2
Fusion
Version 2.0.3
Fusion
Version 2.0.4
Fusion
Version 2.0.5
Fusion
Version 2.0.6
Fusion
Version 2.0.7
Fusion
Version 2.0.8
Fusion
Version 2.0
Fusion
Version 3.1.1
Fusion
Version 3.1.2
Fusion
Version 3.1
Running on/withPlatform Versions
Vmware
Server
Version 2.0.2
Configuration D
3 vulnerable
Vulnerable SoftwareAffected Versions
Vmware
Esxi
Version 3.5
Esxi
Version 4.0
Esxi
Version 4.1
Configuration E
3 vulnerable
Vulnerable SoftwareAffected Versions
Vmware
Esx
Version 3.5
Esx
Version 4.0
Esx
Version 4.1

Related CWEs

CWE-20
Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (20)

Source: cve@mitre.org
Source: cve@mitre.org
Source: cve@mitre.org
Vendor Advisory
Source: cve@mitre.org
Vendor Advisory
Source: cve@mitre.org
Source: cve@mitre.org
Source: cve@mitre.org
Source: cve@mitre.org
Source: cve@mitre.org
Vendor Advisory
Source: cve@mitre.org
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory

Timeline

No history available yet.