Unscored severity · published Jun 6, 2011
CVE-2011-2217
Certain ActiveX controls in (1) tsgetxu71ex552.dll and (2) tsgetx71ex552.dll in Tom Sawyer GET Extension Factory 5.5.2.237, as used in VI Client (aka VMware Infrastructure Client)…
–
CVSS
42%
EPSS
No
On KEV
Description
Certain ActiveX controls in (1) tsgetxu71ex552.dll and (2) tsgetx71ex552.dll in Tom Sawyer GET Extension Factory 5.5.2.237, as used in VI Client (aka VMware Infrastructure Client) 2.0.2 before Build 230598 and 2.5 before Build 204931 in VMware Infrastructure 3, do not properly handle attempted initialization within Internet Explorer, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted HTML document.
Exploitation
Is it being used?
Exploit prediction (EPSS)42.0% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GE
Get Extension Factory · Tomsawyer
5.5.2.237 · source: NVD
IN
Infrastructure · Vmware
3 · source: NVD
VI
Virtual Infrastructure Client · Vmware
2.0.2; 2.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-2217
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-2217
labs.idefense.com
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=911
Vendor Advisory
http://secunia.com/advisories/44826
secunia.com
http://secunia.com/advisories/44844
securitytracker.com
http://securitytracker.com/id?1025602
www.securityfocus.com
http://www.securityfocus.com/bid/48099
Vendor Advisory
http://www.vmware.com/security/advisories/VMSA-2011-0009.html