CVE-2012-2449

Published: May 4, 2012Modified: Apr 29, 2026

9.0

Vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Exploitability: 8.0 / Impact: 10.0

Source: NVD

Description

VMware Workstation 8.x before 8.0.3, VMware Player 4.x before 4.0.3, VMware Fusion 4.x through 4.1.2, VMware ESXi 3.5 through 5.0, and VMware ESX 3.5 through 4.1 do not properly configure the virtual floppy device, which allows guest OS users to cause a denial of service (out-of-bounds write operation and VMX process crash) or possibly execute arbitrary code on the host OS by leveraging administrative privileges on the guest OS.

Affected (29)

Products: Vmware: Workstation, Player, Fusion, Esxi, Esx

5 products

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Vmware Workstation	Version 8.0.1
Vmware Workstation	Version 8.0.2
Vmware Workstation	Version 8.0

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Vmware Player	Version 4.0.1
Vmware Player	Version 4.0.2
Vmware Player	Version 4.0

Configuration C

6 vulnerable

Vulnerable Software	Affected Versions
Vmware Fusion	Version 4.0.1
Vmware Fusion	Version 4.0.2
Vmware Fusion	Version 4.0
Vmware Fusion	Version 4.1.1
Vmware Fusion	Version 4.1.2
Vmware Fusion	Version 4.1

Configuration D

11 vulnerable

Vulnerable Software	Affected Versions
Vmware Esxi	Version 3.5
Vmware Esxi	Version 3.5 1
Vmware Esxi	Version 4.0
Vmware Esxi	Version 4.0 1
Vmware Esxi	Version 4.0 2
Vmware Esxi	Version 4.0 3
Vmware Esxi	Version 4.0 4
Vmware Esxi	Version 4.1
Vmware Esxi	Version 4.1 1
Vmware Esxi	Version 4.1 2
Vmware Esxi	Version 5.0

Configuration E

6 vulnerable

Vulnerable Software	Affected Versions
Vmware Esx	Version 3.5
Vmware Esx	Version 3.5 update1
Vmware Esx	Version 3.5 update2
Vmware Esx	Version 3.5 update3
Vmware Esx	Version 4.0
Vmware Esx	Version 4.1