CVE-2009-3733

MediumCVSS 5.0/10Last modified Jun 16, 2026

Description

Directory traversal vulnerability in VMware Server 1.x before 1.0.10 build 203137 and 2.x before 2.0.2 build 203138 on Linux, VMware ESXi 3.5, and VMware ESX 3.0.3 and 3.5 allows remote attackers to read arbitrary files via unspecified vectors.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:P/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.vmware.com/pipermail/security-announce/2009/000069.htmlPatch, Vendor Advisory
http://secunia.com/advisories/37186Broken Link
http://security.gentoo.org/glsa/glsa-201209-25.xmlThird Party Advisory
http://securitytracker.com/id?1023088Third Party Advisory, VDB Entry
http://securitytracker.com/id?1023089Third Party Advisory, VDB Entry
http://www.securityfocus.com/archive/1/507523/100/0/threadedThird Party Advisory, VDB Entry
http://www.securityfocus.com/bid/36842Third Party Advisory, VDB Entry
http://www.vmware.com/security/advisories/VMSA-2009-0015.htmlPatch, Vendor Advisory
http://www.vupen.com/english/advisories/2009/3062Patch, Vendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7822Third Party Advisory
http://lists.vmware.com/pipermail/security-announce/2009/000069.htmlPatch, Vendor Advisory
http://secunia.com/advisories/37186Broken Link
http://security.gentoo.org/glsa/glsa-201209-25.xmlThird Party Advisory
http://securitytracker.com/id?1023088Third Party Advisory, VDB Entry
http://securitytracker.com/id?1023089Third Party Advisory, VDB Entry
http://www.securityfocus.com/archive/1/507523/100/0/threadedThird Party Advisory, VDB Entry
http://www.securityfocus.com/bid/36842Third Party Advisory, VDB Entry
http://www.vmware.com/security/advisories/VMSA-2009-0015.htmlPatch, Vendor Advisory
http://www.vupen.com/english/advisories/2009/3062Patch, Vendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7822Third Party Advisory

Timeline

Published: Nov 2, 2009
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2009

CVE-2009-37345.0Unspecified vulnerability in the management console in the S2 Security Linear eMerge Access Control System 2.5.x allows remote attackers to CVE-2009-37359.3The ActiveScan Installer ActiveX control in as2stubie.dll before 1.3.3.0 in PandaActiveScan Installer 2.0 in Panda ActiveScan downloads soft CVE-2009-37366.9ltdl.c in libltdl in GNU Libtool 1.5.x, and 2.2.6 before 2.2.6b, as used in Ham Radio Control Libraries, Q, and possibly other products, att CVE-2009-37379.3The Oracle Siebel Option Pack for IE ActiveX control does not properly initialize memory that is used by the NewBusObj method, which allows CVE-2009-373910.0Multiple unspecified vulnerabilities on the Rockwell Automation AB Micrologix 1100 and 1400 controllers allow remote attackers to obtain pri CVE-2009-37424.3Cross-site scripting (XSS) vulnerability in Liferay Portal before 5.3.0 allows remote attackers to inject arbitrary web script or HTML via t CVE-2009-37439.3Off-by-one error in the Ins_MINDEX function in the TrueType bytecode interpreter in Ghostscript before 8.71 allows remote attackers to execu CVE-2009-37445.0rep_serv.exe 6.3.1.3 in the server in EMC RepliStor allows remote attackers to cause a denial of service via a crafted packet to TCP port 71 CVE-2009-37454.3Cross-site scripting (XSS) vulnerability in the help pages in IBM Rational AppScan Enterprise Edition 5.5.0.2 allows remote attackers to inj CVE-2009-37461.9XScreenSaver in Sun Solaris 10, when the accessibility feature is enabled, allows physically proximate attackers to obtain sensitive informa CVE-2009-37474.3Cross-site scripting (XSS) vulnerability in index.php in TBmnetCMS 1.0 allows remote attackers to inject arbitrary web script or HTML via th CVE-2009-37484.3Multiple cross-site scripting (XSS) vulnerabilities in the Web Administrator in Websense Personal Email Manager 7.1 before Hotfix 4 and Emai