NULL pointer dereference in VMware Fusion
CVE-2018-6963
VMware Workstation (14.x before 14.1.2) and Fusion (10.x before 10.1.2) contain multiple denial-of-service vulnerabilities that occur due to NULL pointer dereference issues in the RPC handler. Successful exploitation of these issues may allow an attacker with limited privileges on the guest machine trigger a denial-of-Service of their guest machine.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.004 (31.3th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 31st percentile — 31.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: -0.000
Affected products
- VMware Fusion — versions 10.x before 10.1.2
- VMware Workstation — versions 14.x before 14.1.2
Weakness classification (CWE)
References
- www.securityfocus.com/bid/104237 (VDB Entry, Third Party Advisory, vdb-entry)
- www.securitytracker.com/id/1040957 (VDB Entry, Third Party Advisory, vdb-entry)
- www.vmware.com/security/advisories/VMSA-2018-0013.html (Patch, Vendor Advisory)
Frequently asked questions
- What is CVE-2018-6963?
- CVE-2018-6963 is a medium-severity vulnerability in VMware Fusion, classified under NULL Pointer Dereference. CVSS score: 5.5/10. Published 2018-05-22.
- How severe is CVE-2018-6963?
- Medium severity. CVSS v3 base score is 5.5 out of 10.