CVE-2008-3892

Buffer overflow in a certain ActiveX control in the COM API in VMware Workstation 5.5.x before 5.5.8 build 108000, VMware Workstation 6.0.x before 6.0.5 build 109488, VMware Player 1.x before 1.0.8 build 108000, VMware Player 2.x before 2.0.5 build 109488, VMware ACE 1.x before 1.0.7 build 108880, VMware ACE 2.x before 2.0.5 build 109488, and VMware Server before 1.0.7 build 108231 allows remote attackers to cause a denial of service (browser crash) or possibly execute arbitrary code via a call to the GuestInfo method in which there is a long string argument, and an assignment of a long string value to the result of this call. NOTE: this may overlap CVE-2008-3691, CVE-2008-3692, CVE-2008-3693, CVE-2008-3694, CVE-2008-3695, or CVE-2008-3696.

• CWE-119

• http://lists.grok.org.uk/pipermail/full-disclosure/2008-August/064118.htmlThird Party Advisory
• http://secunia.com/advisories/31707Patch, Third Party Advisory
• http://secunia.com/advisories/31708Patch, Third Party Advisory
• http://secunia.com/advisories/31709Patch, Third Party Advisory
• http://secunia.com/advisories/31710Patch, Third Party Advisory
• http://securityreason.com/securityalert/4202Third Party Advisory
• http://www.securityfocus.com/archive/1/495869/100/0/threadedThird Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/29503Third Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/30934Third Party Advisory, VDB Entry
• http://www.vmware.com/support/ace/doc/releasenotes_ace.htmlVendor Advisory
• http://www.vmware.com/support/ace2/doc/releasenotes_ace2.htmlVendor Advisory
• http://www.vmware.com/support/player/doc/releasenotes_player.htmlVendor Advisory
• http://www.vmware.com/support/player2/doc/releasenotes_player2.htmlVendor Advisory
• http://www.vmware.com/support/server/doc/releasenotes_server.htmlVendor Advisory
• http://www.vmware.com/support/ws55/doc/releasenotes_ws55.htmlVendor Advisory
• http://www.vmware.com/support/ws6/doc/releasenotes_ws6.htmlVendor Advisory
• http://www.vupen.com/english/advisories/2008/2466Third Party Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/43062VDB Entry
• https://www.exploit-db.com/exploits/6345Third Party Advisory, VDB Entry
• http://lists.grok.org.uk/pipermail/full-disclosure/2008-August/064118.htmlThird Party Advisory
• http://secunia.com/advisories/31707Patch, Third Party Advisory
• http://secunia.com/advisories/31708Patch, Third Party Advisory
• http://secunia.com/advisories/31709Patch, Third Party Advisory
• http://secunia.com/advisories/31710Patch, Third Party Advisory
• http://securityreason.com/securityalert/4202Third Party Advisory
• http://www.securityfocus.com/archive/1/495869/100/0/threadedThird Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/29503Third Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/30934Third Party Advisory, VDB Entry
• http://www.vmware.com/support/ace/doc/releasenotes_ace.htmlVendor Advisory
• http://www.vmware.com/support/ace2/doc/releasenotes_ace2.htmlVendor Advisory
• http://www.vmware.com/support/player/doc/releasenotes_player.htmlVendor Advisory
• http://www.vmware.com/support/player2/doc/releasenotes_player2.htmlVendor Advisory
• http://www.vmware.com/support/server/doc/releasenotes_server.htmlVendor Advisory
• http://www.vmware.com/support/ws55/doc/releasenotes_ws55.htmlVendor Advisory
• http://www.vmware.com/support/ws6/doc/releasenotes_ws6.htmlVendor Advisory
• http://www.vupen.com/english/advisories/2008/2466Third Party Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/43062VDB Entry
• https://www.exploit-db.com/exploits/6345Third Party Advisory, VDB Entry

Published

Sep 3, 2008

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2008-3886Multiple cross-site scripting (XSS) vulnerabilities in index…
• CVE-2008-3887Multiple SQL injection vulnerabilities in index.php in dotPr…
• CVE-2008-3888SQL injection vulnerability in members.asp in Mini-NUKE Free…
• CVE-2008-3889Postfix 2.4 before 2.4.9, 2.5 before 2.5.5, and 2.6 before 2…
• CVE-2008-3890The kernel in FreeBSD 6.3 through 7.0 on amd64 platforms can…
• CVE-2008-3891The SAML Single Sign-On (SSO) Service for Google Apps allows…
• CVE-2008-3893Microsoft Bitlocker in Windows Vista before SP1 stores pre-b…5.5
• CVE-2008-3894IBM Lenovo firmware 7CETB5WW 2.05 stores pre-boot authentica…
• CVE-2008-3895LILO 22.6.1 and earlier stores pre-boot authentication passw…
• CVE-2008-3896Grub Legacy 0.97 and earlier stores pre-boot authentication …
• CVE-2008-3897DiskCryptor 0.2.6 on Windows stores pre-boot authentication …
• CVE-2008-3898Secu Star DriveCrypt Plus Pack 3.9 stores pre-boot authentic…