Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-pw1x-gvns-bbcx
Vulnerability ID VCID-pw1x-gvns-bbcx
Aliases CVE-2009-0040
Summary Multiple vulnerabilities have been found in VMware Player, Server, and Workstation, allowing remote and local attackers to conduct several attacks, including privilege escalation, remote execution of arbitrary code, and a Denial of Service.
Status Published
Exploitability 0.5
Weighted Severity 9.0
Risk 4.5
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-824 Access of Uninitialized Pointer
System Score Found at
epss 0.08276 https://api.first.org/data/v1/epss?cve=CVE-2009-0040
epss 0.08276 https://api.first.org/data/v1/epss?cve=CVE-2009-0040
epss 0.08276 https://api.first.org/data/v1/epss?cve=CVE-2009-0040
epss 0.08276 https://api.first.org/data/v1/epss?cve=CVE-2009-0040
epss 0.08276 https://api.first.org/data/v1/epss?cve=CVE-2009-0040
epss 0.08276 https://api.first.org/data/v1/epss?cve=CVE-2009-0040
epss 0.08276 https://api.first.org/data/v1/epss?cve=CVE-2009-0040
epss 0.08276 https://api.first.org/data/v1/epss?cve=CVE-2009-0040
epss 0.08276 https://api.first.org/data/v1/epss?cve=CVE-2009-0040
epss 0.08276 https://api.first.org/data/v1/epss?cve=CVE-2009-0040
cvssv2 6.8 https://nvd.nist.gov/vuln/detail/CVE-2009-0040
generic_textual critical https://www.mozilla.org/en-US/security/advisories/mfsa2009-10
Reference id Reference type URL
ftp://ftp.simplesystems.org/pub/png/src/libpng-1.2.34-ADVISORY.txt
http://downloads.sourceforge.net/libpng/libpng-1.2.34-ADVISORY.txt
http://lists.apple.com/archives/security-announce/2009/Aug/msg00001.html
http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html
http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html
http://lists.apple.com/archives/security-announce/2009/May/msg00002.html
http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00000.html
http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00002.html
http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00009.html
http://lists.vmware.com/pipermail/security-announce/2009/000062.html
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2009-0040.json
https://api.first.org/data/v1/epss?cve=CVE-2009-0040
http://secunia.com/advisories/33970
http://secunia.com/advisories/33976
http://secunia.com/advisories/34137
http://secunia.com/advisories/34140
http://secunia.com/advisories/34143
http://secunia.com/advisories/34145
http://secunia.com/advisories/34152
http://secunia.com/advisories/34210
http://secunia.com/advisories/34265
http://secunia.com/advisories/34272
http://secunia.com/advisories/34320
http://secunia.com/advisories/34324
http://secunia.com/advisories/34388
http://secunia.com/advisories/34462
http://secunia.com/advisories/34464
http://secunia.com/advisories/35074
http://secunia.com/advisories/35258
http://secunia.com/advisories/35302
http://secunia.com/advisories/35379
http://secunia.com/advisories/35386
http://secunia.com/advisories/36096
http://security.gentoo.org/glsa/glsa-200903-28.xml
http://security.gentoo.org/glsa/glsa-201209-25.xml
https://exchange.xforce.ibmcloud.com/vulnerabilities/48819
http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.405420
http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.433952
http://sourceforge.net/mailarchive/message.php?msg_name=e56ccc8f0902181726i200f4bf0n20d919473ec409b7%40mail.gmail.com
http://sourceforge.net/project/shownotes.php?group_id=1689&release_id=662441
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10316
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6458
http://sunsolve.sun.com/search/document.do?assetkey=1-66-259989-1
http://sunsolve.sun.com/search/document.do?assetkey=1-77-1020521.1-1
http://support.apple.com/kb/HT3549
http://support.apple.com/kb/HT3613
http://support.apple.com/kb/HT3639
http://support.apple.com/kb/HT3757
http://support.avaya.com/elmodocs2/security/ASA-2009-069.htm
http://support.avaya.com/elmodocs2/security/ASA-2009-208.htm
http://support.avaya.com/japple/css/japple?temp.documentID=366362&temp.productID=154235&temp.releaseID=361845&temp.bucketID=126655&PAGE=Document
https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00272.html
https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00412.html
https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00769.html
https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00771.html
http://wiki.rpath.com/Advisories:rPSA-2009-0046
http://www.debian.org/security/2009/dsa-1750
http://www.debian.org/security/2009/dsa-1830
http://www.kb.cert.org/vuls/id/649212
http://www.mandriva.com/security/advisories?name=MDVSA-2009:051
http://www.mandriva.com/security/advisories?name=MDVSA-2009:075
http://www.mandriva.com/security/advisories?name=MDVSA-2009:083
http://www.redhat.com/support/errata/RHSA-2009-0315.html
http://www.redhat.com/support/errata/RHSA-2009-0325.html
http://www.redhat.com/support/errata/RHSA-2009-0333.html
http://www.redhat.com/support/errata/RHSA-2009-0340.html
http://www.securityfocus.com/archive/1/501767/100/0/threaded
http://www.securityfocus.com/archive/1/503912/100/0/threaded
http://www.securityfocus.com/archive/1/505990/100/0/threaded
http://www.securityfocus.com/bid/33827
http://www.securityfocus.com/bid/33990
http://www.us-cert.gov/cas/techalerts/TA09-133A.html
http://www.us-cert.gov/cas/techalerts/TA09-218A.html
http://www.vmware.com/security/advisories/VMSA-2009-0007.html
http://www.vupen.com/english/advisories/2009/0469
http://www.vupen.com/english/advisories/2009/0473
http://www.vupen.com/english/advisories/2009/0632
http://www.vupen.com/english/advisories/2009/1297
http://www.vupen.com/english/advisories/2009/1451
http://www.vupen.com/english/advisories/2009/1462
http://www.vupen.com/english/advisories/2009/1522
http://www.vupen.com/english/advisories/2009/1560
http://www.vupen.com/english/advisories/2009/1621
http://www.vupen.com/english/advisories/2009/2172
486355 https://bugzilla.redhat.com/show_bug.cgi?id=486355
cpe:2.3:a:libpng:libpng:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:libpng:libpng:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:4.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:4.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:5.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:5.0:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:10:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:fedoraproject:fedora:10:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:9:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:fedoraproject:fedora:9:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:opensuse:10.3:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:opensuse:opensuse:10.3:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:opensuse:11.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:opensuse:opensuse:11.0:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:opensuse:11.1:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:opensuse:opensuse:11.1:*:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise:10.0:-:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:suse:linux_enterprise:10.0:-:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise:9.0:-:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:suse:linux_enterprise:9.0:-:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_desktop:10:sp2:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:suse:linux_enterprise_desktop:10:sp2:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_server:10:sp2:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:suse:linux_enterprise_server:10:sp2:*:*:*:*:*:*
CVE-2009-0040 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0040
CVE-2009-0040 https://nvd.nist.gov/vuln/detail/CVE-2009-0040
GLSA-200903-28 https://security.gentoo.org/glsa/200903-28
GLSA-201209-25 https://security.gentoo.org/glsa/201209-25
GLSA-201412-08 https://security.gentoo.org/glsa/201412-08
mfsa2009-10 https://www.mozilla.org/en-US/security/advisories/mfsa2009-10
RHSA-2009:0315 https://access.redhat.com/errata/RHSA-2009:0315
RHSA-2009:0325 https://access.redhat.com/errata/RHSA-2009:0325
RHSA-2009:0333 https://access.redhat.com/errata/RHSA-2009:0333
RHSA-2009:0340 https://access.redhat.com/errata/RHSA-2009:0340
USN-728-1 https://usn.ubuntu.com/728-1/
USN-730-1 https://usn.ubuntu.com/730-1/
No exploits are available.
Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P Found at https://nvd.nist.gov/vuln/detail/CVE-2009-0040
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Exploit Prediction Scoring System (EPSS)
Percentile 0.92209
EPSS Score 0.08276
Published At April 1, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T13:00:36.566878+00:00 Gentoo Importer Import https://security.gentoo.org/glsa/201209-25 38.0.0