{"containers": {"cna": {"affected": [{"product": "Workstation Pro / Player", "vendor": "VMware", "versions": [{"status": "affected", "version": "14.x before 14.1.1"}, {"status": "affected", "version": "12.x before 12.5.9"}]}, {"product": "Fusion", "vendor": "VMware", "versions": [{"status": "affected", "version": "10.x before 10.1.1"}, {"status": "affected", "version": "8.x before 8.5.10"}]}], "datePublic": "2017-01-10T00:00:00", "descriptions": [{"lang": "en", "value": "VMware Workstation and Fusion contain a use-after-free vulnerability in VMware NAT service when IPv6 mode is enabled. This issue may allow a guest to execute code on the host. Note: IPv6 mode for VMNAT is not enabled by default."}], "problemTypes": [{"descriptions": [{"description": "Use-after-free vulnerability", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-01-12T10:57:01", "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "shortName": "vmware"}, "references": [{"name": "1040161", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id/1040161"}, {"name": "102489", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/102489"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://www.vmware.com/security/advisories/VMSA-2018-0005.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@vmware.com", "DATE_PUBLIC": "2017-01-10T00:00:00", "ID": "CVE-2017-4949", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Workstation Pro / Player", "version": {"version_data": [{"version_value": "14.x before 14.1.1"}, {"version_value": "12.x before 12.5.9"}]}}, {"product_name": "Fusion", "version": {"version_data": [{"version_value": "10.x before 10.1.1"}, {"version_value": "8.x before 8.5.10"}]}}]}, "vendor_name": "VMware"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "VMware Workstation and Fusion contain a use-after-free vulnerability in VMware NAT service when IPv6 mode is enabled. This issue may allow a guest to execute code on the host. Note: IPv6 mode for VMNAT is not enabled by default."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Use-after-free vulnerability"}]}]}, "references": {"reference_data": [{"name": "1040161", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id/1040161"}, {"name": "102489", "refsource": "BID", "url": "http://www.securityfocus.com/bid/102489"}, {"name": "https://www.vmware.com/security/advisories/VMSA-2018-0005.html", "refsource": "CONFIRM", "url": "https://www.vmware.com/security/advisories/VMSA-2018-0005.html"}]}}}}, "cveMetadata": {"assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "assignerShortName": "vmware", "cveId": "CVE-2017-4949", "datePublished": "2017-01-10T00:00:00", "dateReserved": "2016-12-26T00:00:00", "dateUpdated": "2018-01-12T10:57:01", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:vmware:fusion:*:*:*:*:*:*:*:*", "matchCriteriaId": "2EE84B0E-1550-4DE8-9454-AF2F51CDE208", "versionEndExcluding": "8.5.10", "versionStartIncluding": "8.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:fusion:*:*:*:*:*:*:*:*", "matchCriteriaId": "F7419FA0-119C-4C1C-A071-90A9F8ECDB32", "versionEndExcluding": "10.1.1", "versionStartIncluding": "10.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*", "matchCriteriaId": "4781BF1E-8A4E-4AFF-9540-23D523EE30DD", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:vmware:workstation:*:*:*:*:*:*:*:*", "matchCriteriaId": "AD8033E5-38A7-4262-8FB0-937534F4C41F", "versionEndExcluding": "12.5.9", "versionStartIncluding": "12.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:workstation:*:*:*:*:*:*:*:*", "matchCriteriaId": "D13A3189-D26A-4F29-9C49-6083F5951B81", "versionEndExcluding": "14.1.1", "versionStartIncluding": "14.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "VMware Workstation and Fusion contain a use-after-free vulnerability in VMware NAT service when IPv6 mode is enabled. This issue may allow a guest to execute code on the host. Note: IPv6 mode for VMNAT is not enabled by default."}, {"lang": "es", "value": "VMware Workstation y Fusion contienen una vulnerabilidad de uso de memoria previamente liberada en el servicio VMware NAT cuando el modo IPv6 est\u00e1 habilitado. Este problema puede permitir que un invitado ejecute c\u00f3digo en el host. Nota: El modo IPv6 para VMNAT no est\u00e1 habilitado por defecto."}], "id": "CVE-2017-4949", "lastModified": "2018-02-13T00:34:02.350", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 6.9, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 3.4, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.0, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2018-01-11T14:29:00.213", "references": [{"source": "security@vmware.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/102489"}, {"source": "security@vmware.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securitytracker.com/id/1040161"}, {"source": "security@vmware.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://www.vmware.com/security/advisories/VMSA-2018-0005.html"}], "sourceIdentifier": "security@vmware.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}