CVE-2014-8370

Severity: medium (CVSS 6.4 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2015-01-29 · updated 2026-06-17
Weakness: CWE-264

Description

VMware Workstation 10.x before 10.0.5, VMware Player 6.x before 6.0.5, VMware Fusion 6.x before 6.0.5, and VMware ESXi 5.0 through 5.5 allow host OS users to gain host OS privileges or cause a denial of service (arbitrary write to a file) by modifying a configuration file.

Affected products

VMware ESXi: 5.0-1, 5.0-2, 5.1-1; 5.0, 5.1, 5.5 (and their updates)
VMware Fusion: 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4 (and their updates)
VMware Player: 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4 (and their updates)
VMware Workstation: 10.0, 10.0.1, 10.0.2, 10.0.3, 10.0.4 (and their updates)

References

http://jvn.jp/en/jp/JVN88252465/index.html
http://jvndb.jvn.jp/jvndb/JVNDB-2015-000007
http://secunia.com/advisories/62551
http://secunia.com/advisories/62605
http://secunia.com/advisories/62669
http://www.securityfocus.com/bid/72338
http://www.securitytracker.com/id/1031642
http://www.securitytracker.com/id/1031643
http://www.vmware.com/security/advisories/VMSA-2015-0001.html
https://exchange.xforce.ibmcloud.com/vulnerabilities/100933
http://jvn.jp/en/jp/JVN88252465/index.html
http://jvndb.jvn.jp/jvndb/JVNDB-2015-000007

Get alerted when CVE-2014-8370 or the next vulnerability affects your stack