"Multiple security issues" were patched for a number of VMware products, according to a company security advisory.
The advisory addressed critical flaws in VMware ESXi, Workstation, Fusion, and Tools.
VMware Workstation contains vulnerabilities that may allow a Windows-based Virtual Machine (VM) to trigger a heap-based buffer overflow, the advisory stated. Exploitation could lead to arbitrary code execution. Another vulnerability could allow a Windows-based VM to corrupt memory, leading to arbitrary code execution.
Local privilege escalation on Virtual Machines that run OSX could be affected by memory being handled incorrectly leading to NULL pointer dereference vulnerabilities.
As well, a DLL hijacking issue affects the firm's Workstation installer causing DLL files to be loaded by the application improperly. This could enable an attacker to load a DLL file to execute arbitrary code. Finally, the Workstation installer also contains an insecure executable-loading vulnerability. This bug could enable an attacker to execute an exe file placed in the same directory as Installer, allow the attacker to execute arbitrary code.
US-CERT advises that users "apply the necessary updates."
