vulnwire
8.8high

CVE-2018-6983

VMware Workstation (15.x before 15.0.2 and 14.x before 14.1.5) and Fusion (11.x before 11.0.2 and 10.x before 10.1.5) contain an integer ov…

Published 7 y ago · modified 4 mo ago · JSON

CVSS
8.8
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.5%
percentile 39%
Public exploits
0
none known

VMware Workstation (15.x before 15.0.2 and 14.x before 14.1.5) and Fusion (11.x before 11.0.2 and 10.x before 10.1.5) contain an integer overflow vulnerability in the virtual network devices. This issue may allow a guest to execute code on the host.

Exploit prediction (EPSS)

0.45% probability of exploitation in the next 30 days, higher than 39% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.08.8CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
NVD2.07.2AV:L/AC:L/Au:N/C:C/I:C/A:C

Affected products

  • VMware VMware Workstation and Fusion

Classification

Weakness
  • CWE-190 Integer Overflow or Wraparound
Technology feeds
VMware (RSS, critical only)

References

  • vmware.com /security/advisories/VMSA-2018-0030.html · x_refsource_CONFIRM, x_transferred
  • securityfocus.com /bid/105986 · vdb-entry, x_refsource_BID, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.