CVE-2017-4918

EUVD-2017-14035
VMware Horizon View Client (2.x, 3.x and 4.x prior to 4.5.0) contains a command injection vulnerability in the service startup script. Successful exploitation of this issue may allow unprivileged users to escalate their privileges to root on the Mac OSX system where the client is installed.
Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 86%
Affected Products (NVD)
VendorProductVersion
vmwarehorizon_view
2.0
vmwarehorizon_view
2.1
vmwarehorizon_view
2.2
vmwarehorizon_view
2.3
vmwarehorizon_view
3.0
vmwarehorizon_view
3.1
vmwarehorizon_view
3.2
vmwarehorizon_view
3.3
vmwarehorizon_view
4.0.0
vmwarehorizon_view
4.0.1
vmwarehorizon_view
4.1.0
vmwarehorizon_view
4.2.0
vmwarehorizon_view
4.3.0
vmwarehorizon_view
4.4.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://www.securityfocus.com/bid/98984
http://www.securitytracker.com/id/1038642
https://www.vmware.com/security/advisories/VMSA-2017-0011.html
http://www.securityfocus.com/bid/98984
http://www.securitytracker.com/id/1038642
https://www.vmware.com/security/advisories/VMSA-2017-0011.html