VMware Fusion Pro vulnerabilities

5 CVEs affecting VMware Fusion Pro, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2017-4905, published 2017-06-07.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2017-4905, published 2017-06-07. Medium severity, CVSS 5.5. EPSS: 1.2% chance of exploitation in the next 30 days. VMware ESXi 6.5 without patch ESXi650-201703410-SG, 6.0 U3 without patch ESXi600-201703401-SG, 6.0 U2 without patch ESXi600-201703403-SG, 6.0 U1 without patch ESXi600-201703402-SG, 5.5 without patch…
CVE-2016-7461, published 2016-12-29. High severity, CVSS 8.8. EPSS: 0.6% chance of exploitation in the next 30 days. The drag-and-drop (aka DnD) function in VMware Workstation Pro 12.x before 12.5.2 and VMware Workstation Player 12.x before 12.5.2 and VMware Fusion and Fusion Pro 8.x before 8.5.2 allows guest OS…
CVE-2017-4902, published 2017-06-07. High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days. VMware ESXi 6.5 without patch ESXi650-201703410-SG and 5.5 without patch ESXi550-201703401-SG; Workstation Pro / Player 12.x prior to 12.5.5; and Fusion Pro / Fusion 8.x prior to 8.5.6 have a Heap…
CVE-2017-4904, published 2017-06-07. High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days. The XHCI controller in VMware ESXi 6.5 without patch ESXi650-201703410-SG, 6.0 U3 without patch ESXi600-201703401-SG, 6.0 U2 without patch ESXi600-201703403-SG, 6.0 U1 without patch…
CVE-2017-4903, published 2017-06-07. High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days. VMware ESXi 6.5 without patch ESXi650-201703410-SG, 6.0 U3 without patch ESXi600-201703401-SG, 6.0 U2 without patch ESXi600-201703403-SG, 6.0 U1 without patch ESXi600-201703402-SG, and 5.5 without…