Unscored severity · published Sep 8, 2009
CVE-2009-2628
The VMnc media codec in vmnc.dll in VMware Movie Decoder before 6.5.3 build 185404, VMware Workstation 6.5.x before 6.5.3 build 185404, VMware Player 2.5.x before 2.5.3 build…
–
CVSS
5.6%
EPSS
No
On KEV
Description
The VMnc media codec in vmnc.dll in VMware Movie Decoder before 6.5.3 build 185404, VMware Workstation 6.5.x before 6.5.3 build 185404, VMware Player 2.5.x before 2.5.3 build 185404, and VMware ACE 2.5.x before 2.5.3 build 185404 on Windows does not properly handle certain small heights in video content, which might allow remote attackers to execute arbitrary code via a crafted AVI file that triggers heap memory corruption.
Exploitation
Is it being used?
Exploit prediction (EPSS)5.6% · higher than 93% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AC
Ace · Vmware
2.5.0; 2.5.1; 2.5.2 · source: NVD
MD
Movie Decoder · Vmware
6.5.3 · source: NVD
PL
Player · Vmware
2.5; 2.5.1; 2.5.2 · source: NVD
WO
Workstation · Vmware
6.5; 6.5.0; 6.5.1; 6.5.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-2628
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-2628
Patch
http://lists.vmware.com/pipermail/security-announce/2009/000065.html
Vendor Advisory
http://secunia.com/advisories/34938
US Government Resource
http://www.kb.cert.org/vuls/id/444513
www.securityfocus.com
http://www.securityfocus.com/archive/1/506286/100/0/threaded
Patch
http://www.securityfocus.com/bid/36290
Patch
http://www.vmware.com/security/advisories/VMSA-2009-0012.html
More from Ace
–
CVE-2009-4811
VMware Authentication Daemon 1.0 in vmware-authd.exe in the VMware Authorization Service in VMware Workstation 7.0 before 7.0.1 build 227600 and 6.5.x before 6.5.4 build 246459,…
–
CVE-2010-1142
VMware Tools in VMware Workstation 6.5.x before 6.5.4 build 246459; VMware Player 2.5.x before 2.5.4 build 246459; VMware ACE 2.5.x before 2.5.4 build 246459; VMware Server 2.x…
–
CVE-2010-1141
VMware Tools in VMware Workstation 6.5.x before 6.5.4 build 246459; VMware Player 2.5.x before 2.5.4 build 246459; VMware ACE 2.5.x before 2.5.4 build 246459; VMware Server 2.x…
–
CVE-2010-1138
The virtual networking stack in VMware Workstation 7.0 before 7.0.1 build 227600, VMware Workstation 6.5.x before 6.5.4 build 246459 on Windows, VMware Player 3.0 before 3.0.1…
–
CVE-2009-3732
Format string vulnerability in vmware-vmrc.exe build 158248 in VMware Remote Console (aka VMrc) allows remote attackers to execute arbitrary code via unspecified vectors