Multiple vulnerabilities have been discovered in VMware Unified Access Gateway, VMware Horizon View, VMware Horizon View Client for Windows, and VMware Workstation Pro and Player. The most severe of these vulnerabilities could allow for code execution. Details of these vulnerabilities are as follows:

• A heap-overflow vulnerability in Unified Access Gateway and Horizon View that allows a remote attacker to execute code on the security gateway (CVE-2017-4907).
• Two heap buffer-overflow vulnerabilities in VMware Workstation and Horizon View Client for Windows that may allow a guest to execute code or perform a denial of service attack (CVE-2017-4908, CVE-2017-4909).
• Three out-of-bounds read/write vulnerabilities in VMware Workstation and Horizon View Client for Windows that may allow a guest to execute code or perform a denial of service attack (CVE-2017-4910, CVE-2017-4911, CVE-2017-4912).
• An integer-overflow vulnerability in VMware Workstation and Horizon View Client for Windows that allows a guest to execute code or perform a denial of service attack (CVE-2017-4913).

Successful exploitation of the most severe of these vulnerabilities could allow for code execution in the context of the logged on user. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.