CVE-2008-3892 in the critical feed json
Buffer overflow in a certain ActiveX control in the COM API in VMware Workstation 5.5.x before 5.5.8 build 108000, VMware Workstation 6.0.x…
published 2008-09-03 18 y ago modified 2026-06-16 4 mo ago also EUVD-2008-3878
- cvss
- 10.0
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 24.4%
- EPSS 24.4% chance of exploitation in 30 days, percentile 97%
- public exploits
- 1
- Exploit-DB
Summary
Buffer overflow in a certain ActiveX control in the COM API in VMware Workstation 5.5.x before 5.5.8 build 108000, VMware Workstation 6.0.x before 6.0.5 build 109488, VMware Player 1.x before 1.0.8 build 108000, VMware Player 2.x before 2.0.5 build 109488, VMware ACE 1.x before 1.0.7 build 108880, VMware ACE 2.x before 2.0.5 build 109488, and VMware Server before 1.0.7 build 108231 allows remote attackers to cause a denial of service (browser crash) or possibly execute arbitrary code via a call to the GuestInfo method in which there is a long string argument, and an assignment of a long string value to the result of this call. NOTE: this may overlap CVE-2008-3691, CVE-2008-3692, CVE-2008-3693, CVE-2008-3694, CVE-2008-3695, or CVE-2008-3696.
Patch / fix
- vmware ace 1.0.7, 2.0.5
- vmware player 1.0.8, 2.0.5
- vmware server 1.0.7
- vmware workstation 5.5.8, 6.0.5
- secunia.com/advisories/31709 advisory
- secunia.com/advisories/31710 advisory
- secunia.com/advisories/31707 advisory
- secunia.com/advisories/31708 advisory
Timeline
- First public exploit (EDB-6345)
- Published
Exploit prediction
24.36% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- EDB-6345 VMware - COM API ActiveX Remote Buffer Overflow (PoC) dos, 2008-09-01
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 10.0 | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Classification
- Weakness
-
- CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
- Technology feeds
References
-
secunia.com
/advisories/31709
third-party-advisory, patch
-
secunia.com
/advisories/31710
third-party-advisory, patch
-
secunia.com
/advisories/31707
third-party-advisory, patch
-
secunia.com
/advisories/31708
third-party-advisory, patch
-
exploit-db.com
/exploits/6345
exploit, third-party-advisory, vdb-entry
-
vmware.com
/support/server/doc/releasenotes_server.html
vendor-advisory
-
vmware.com
/support/ace/doc/releasenotes_ace.html
vendor-advisory
-
vmware.com
/support/ws6/doc/releasenotes_ws6.html
vendor-advisory
-
vmware.com
/support/ws55/doc/releasenotes_ws55.html
vendor-advisory
-
vmware.com
/support/player2/doc/releasenotes_player2.html
vendor-advisory
-
vmware.com
/support/ace2/doc/releasenotes_ace2.html
vendor-advisory
-
vmware.com
/support/player/doc/releasenotes_player.html
vendor-advisory
-
exchange.xforce.ibmcloud.com
/vulnerabilities/43062
vdb-entry
-
securityfocus.com
/bid/30934
vdb-entry, third-party-advisory
-
securityfocus.com
/archive/1/495869/100/0/threaded
mailing-list, third-party-advisory, vdb-entry
-
lists.grok.org.uk
/pipermail/full-disclosure/2008-August/064118.html
mailing-list, third-party-advisory
-
securityfocus.com
/bid/29503
vdb-entry, third-party-advisory
-
securityreason.com
/securityalert/4202
third-party-advisory
-
vupen.com
/english/advisories/2008/2466
vdb-entry, third-party-advisory
Sources
- CVE List CVE-2008-3892
- NVD CVE-2008-3892
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.