NULL pointer dereference in Vmware Fusion
CVE-2018-6963
VMware Workstation (14.x before 14.1.2) and Fusion (10.x before 10.1.2) contain multiple denial-of-service vulnerabilities that occur due to NULL pointer dereference issues in the RPC handler. Successful exploitation of these issues may allow an attacker with limited privileges on the guest machine trigger a denial-of-Service of their guest machine.
EPSS: 0.004 (33.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Vmware Fusion — versions 10.x before 10.1.2
- Vmware Workstation — versions 14.x before 14.1.2
Weakness classification (CWE)
References
- security@vmware.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
- security@vmware.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_SECTRACK)
- security@vmware.com (x_refsource_CONFIRM, Patch, Vendor Advisory)
Frequently asked questions
- What is CVE-2018-6963?
- CVE-2018-6963 is a medium-severity vulnerability in Vmware Fusion, classified under NULL Pointer Dereference. CVSS score: 5.5/10. Published 2018-05-22.
- How severe is CVE-2018-6963?
- Medium severity. CVSS v3 base score is 5.5 out of 10.