VMware Workstation / Player Multiple Vulnerabilities

Multiple vulnerabilities have been identified in VMware Workstation and VMware Player, which can be exploited by malicious, local users to gain escalated privileges and by malicious people to compromise a user's system.

1. An error due to insecure permissions being assigned to process threads when creating certain processes can be exploited to hijack the threads.
2. The application loads certain libraries in an insecure manner, which can be exploited to load arbitrary libraries by tricking a user into e.g. opening a file located on a remote WebDAV or SMB share.
3. The application bundles a vulnerable version of OVF Tool.

A remote user can create a specially crafted OVF file that, when loaded by the target user via the OVF Tool, will trigger a format string flaw and execute arbitrary code on the target user's system. The code will run with the privileges of the target user.