CVE-2017-4918

Severity: critical (CVSS 9.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-06-08 · updated 2026-06-17
Weakness: CWE-77

Description

VMware Horizon View Client (2.x, 3.x and 4.x prior to 4.5.0) contains a command injection vulnerability in the service startup script. Successful exploitation of this issue may allow unprivileged users to escalate their privileges to root on the Mac OSX system where the client is installed.

Affected products

VMware Horizon View: 2.0, 2.1, 2.2, 2.3, 3.0, 3.1 (+8)
VMware Horizon View: from 4.x prior through 4.5.0; 2.x, 3.x

References

http://www.securityfocus.com/bid/98984
http://www.securitytracker.com/id/1038642
https://www.vmware.com/security/advisories/VMSA-2017-0011.html
http://www.securityfocus.com/bid/98984
http://www.securitytracker.com/id/1038642
https://www.vmware.com/security/advisories/VMSA-2017-0011.html

Get alerted when CVE-2017-4918 or the next vulnerability affects your stack