CVE-2015-3650

Published: Jul 10, 2015Modified: May 6, 2026

7.2

Vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability: 3.9 / Impact: 10.0

Source: NVD

Description

vmware-vmx.exe in VMware Workstation 7.x through 10.x before 10.0.7 and 11.x before 11.1.1, VMware Player 5.x and 6.x before 6.0.7 and 7.x before 7.1.1, and VMware Horizon Client 5.x local-mode before 5.4.2 on Windows does not provide a valid DACL pointer during the setup of the vprintproxy.exe process, which allows host OS users to gain host OS privileges by injecting a thread.

Affected (25)

Products: Vmware: Player, Workstation, Horizon View Client

3 products

Configuration A

14 vulnerable

Vulnerable Software	Affected Versions
Vmware Player	Version 5.0.1
Vmware Player	Version 5.0.2
Vmware Player	Version 5.0.3
Vmware Player	Version 5.0.4
Vmware Player	Version 5.0
Vmware Player	Version 6.0.1
Vmware Player	Version 6.0.2
Vmware Player	Version 6.0.3
Vmware Player	Version 6.0.4
Vmware Player	Version 6.0.5
Vmware Player	Version 6.0.6
Vmware Player	Version 6.0
Vmware Player	Version 7.0
Vmware Player	Version 7.1

Configuration B

9 vulnerable

Vulnerable Software	Affected Versions
Vmware Workstation	Version 10.0.1
Vmware Workstation	Version 10.0.2
Vmware Workstation	Version 10.0.3
Vmware Workstation	Version 10.0.4
Vmware Workstation	Version 10.0.5
Vmware Workstation	Version 10.0.6
Vmware Workstation	Version 10.0
Vmware Workstation	Version 11.0
Vmware Workstation	Version 11.1