CVE-2017-4904

Published: Jun 7, 2017Modified: May 13, 2026

8.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Exploitability: 2.0 / Impact: 6.0

Source: NVD

Description

The XHCI controller in VMware ESXi 6.5 without patch ESXi650-201703410-SG, 6.0 U3 without patch ESXi600-201703401-SG, 6.0 U2 without patch ESXi600-201703403-SG, 6.0 U1 without patch ESXi600-201703402-SG, and 5.5 without patch ESXi550-201703401-SG; Workstation Pro / Player 12.x prior to 12.5.5; and Fusion Pro / Fusion 8.x prior to 8.5.6 has uninitialized memory usage. This issue may allow a guest to execute code on the host. The issue is reduced to a Denial of Service of the guest on ESXi 5.5.

Affected (17)

Products: Vmware: Fusion, Fusion Pro, Esxi, Workstation Player, Workstation Pro

5 products

Configuration A

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Vmware Fusion	From 8.0.0 to 8.5.6
Vmware Fusion Pro	From 8.0.0 to 8.5.6

Running on/with	Platform Versions
Apple Mac Os X	All versions

Configuration B

15 vulnerable

Vulnerable Software	Affected Versions
Vmware Esxi	Version 5.5
Vmware Esxi	Version 5.5 1
Vmware Esxi	Version 5.5 2
Vmware Esxi	Version 5.5 3a
Vmware Esxi	Version 5.5 3b
Vmware Esxi	Version 6.0
Vmware Esxi	Version 6.0 1
Vmware Esxi	Version 6.0 1a
Vmware Esxi	Version 6.0 1b
Vmware Esxi	Version 6.0 2
Vmware Esxi	Version 6.0 3
Vmware Esxi	Version 6.0 3a
Vmware Esxi	Version 6.5
Vmware Workstation Player	From 12.0.0 to 12.5.5
Vmware Workstation Pro	From 12.0.0 to 12.5.5