CVE-2010-4295

MediumCVSS 6.9/10Last modified Jun 16, 2026

Description

Race condition in the mounting process in vmware-mount in VMware Workstation 7.x before 7.1.2 build 301548 on Linux, VMware Player 3.1.x before 3.1.2 build 301548 on Linux, VMware Server 2.0.2 on Linux, and VMware Fusion 3.1.x before 3.1.2 build 332101 allows host OS users to gain privileges via vectors involving temporary files.

Metrics

CVSS 2.0 6.9/10AV:L/AC:M/Au:N/C:C/I:C/A:C

Weakness enumeration

CWE-362

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.vmware.com/pipermail/security-announce/2010/000112.htmlMailing List, Vendor Advisory
http://osvdb.org/69585Broken Link
http://secunia.com/advisories/42453Broken Link, Vendor Advisory
http://secunia.com/advisories/42482Broken Link, Vendor Advisory
http://www.securityfocus.com/archive/1/514995/100/0/threadedBroken Link, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/45167Broken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id?1024819Broken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id?1024820Broken Link, Third Party Advisory, VDB Entry
http://www.vmware.com/security/advisories/VMSA-2010-0018.htmlVendor Advisory
http://www.vupen.com/english/advisories/2010/3116Broken Link, Vendor Advisory
http://lists.vmware.com/pipermail/security-announce/2010/000112.htmlMailing List, Vendor Advisory
http://osvdb.org/69585Broken Link
http://secunia.com/advisories/42453Broken Link, Vendor Advisory
http://secunia.com/advisories/42482Broken Link, Vendor Advisory
http://www.securityfocus.com/archive/1/514995/100/0/threadedBroken Link, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/45167Broken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id?1024819Broken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id?1024820Broken Link, Third Party Advisory, VDB Entry
http://www.vmware.com/security/advisories/VMSA-2010-0018.htmlVendor Advisory
http://www.vupen.com/english/advisories/2010/3116Broken Link, Vendor Advisory

Timeline

Published: Dec 6, 2010
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2010

CVE-2010-42967.2vmware-mount in VMware Workstation 7.x before 7.1.2 build 301548 on Linux, VMware Player 3.1.x before 3.1.2 build 301548 on Linux, VMware Se CVE-2010-42977.2The VMware Tools update functionality in VMware Workstation 6.5.x before 6.5.5 build 328052 and 7.x before 7.1.2 build 301548; VMware Player CVE-2010-42987.5SQL injection vulnerability in the download module in Free Simple Software 1.0 allows remote attackers to execute arbitrary SQL commands via CVE-2010-42999.3Heap-based buffer overflow in ZfHIPCND.exe in Novell Zenworks 7 Handheld Management (ZHM) allows remote attackers to execute arbitrary code CVE-2010-43007.5Heap-based buffer overflow in the dissect_ldss_transfer function (epan/dissectors/packet-ldss.c) in the LDSS dissector in Wireshark 1.2.0 th CVE-2010-43015.0epan/dissectors/packet-zbee-zcl.c in the ZigBee ZCL dissector in Wireshark 1.4.0 through 1.4.1 allows remote attackers to cause a denial of CVE-2010-43024.9/opt/rv/Versions/CurrentVersion/Mcu/Config/Mcu.val in Cisco Unified Videoconferencing (UVC) System 5110 and 5115, when the Linux operating s CVE-2010-43034.9Cisco Unified Videoconferencing (UVC) System 5110 and 5115, when the Linux operating system is used, uses world-readable permissions for the CVE-2010-43046.4The web interface in Cisco Unified Videoconferencing (UVC) System 3545, 5110, 5115, and 5230; Unified Videoconferencing 3527 Primary Rate In CVE-2010-43055.0Cisco Unified Videoconferencing (UVC) System 3545, 5110, 5115, and 5230; Unified Videoconferencing 3527 Primary Rate Interface (PRI) Gateway CVE-2010-43069.3Adobe Shockwave Player before 11.5.9.620 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via uns CVE-2010-43079.3Buffer overflow in Adobe Shockwave Player before 11.5.9.620 allows attackers to execute arbitrary code via unspecified vectors.