Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2009-2628

The VMnc media codec in vmnc.dll in VMware Movie Decoder before 6.5.3 build 185404, VMware Workstation 6.5.x before 6.5.3 build 185404, VMware Player 2.5.x before 2.5.3 build 185404, and VMware ACE 2.5.x before 2.5.3 build 185404 on Windows does not properly handle certain small heights in video content, which might allow remote attackers to execute arbitrary code via a crafted AVI file that triggers heap memory corruption.

Published

2009-09-08T22:30:00.483

Last Modified

2025-04-09T00:30:58.490

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 9.3 (HIGH)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

  • Access Vector: NETWORK
  • Access Complexity: MEDIUM
  • Authentication: NONE
  • Confidentiality Impact: COMPLETE
  • Integrity Impact: COMPLETE
  • Availability Impact: COMPLETE
Exploitability Score

8.6

Impact Score

10.0

Weaknesses
  • Type: Primary
    CWE-94
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application vmware ace 2.5.0 Yes
Application vmware ace 2.5.1 Yes
Application vmware ace 2.5.2 Yes
Application vmware movie_decoder 6.5.3 Yes
Application vmware player 2.5 Yes
Application vmware player 2.5.1 Yes
Application vmware player 2.5.2 Yes
Application vmware workstation 6.5 Yes
Application vmware workstation 6.5.0 Yes
Application vmware workstation 6.5.1 Yes
Application vmware workstation 6.5.2 Yes
References