GCVE - cpe:2.3:a:hashicorp:vagrant_vmware_fusion:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:hashicorp:vagrant_vmware_fusion:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Hashicorp (`dc524c16-6a01-528e-a41c-9d3e02e5e4a3`)
Product	Vagrant Vmware Fusion (`4ca23c58-dde0-588a-9a2c-40dfb344f4d3`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/hashicorp/vagrant-plugin-changelog`	purl2cpe	2026-06-01 10:14:57.610210

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2017-7642`	vulnerable	2026-06-08 05:09:56.694264	Details available The sudo helper in the HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) before 4.0.21 allows local users to gain root privileges by leveraging failure to verify the path to the encoded ruby script or scrub the PATH variable. Published: 2017-08-02T19:00:00.000Z Updated: 2024-08-05T16:12:27.868Z Open on db.gcve.eu Reference links http://seclists.org/fulldisclosure/2017/Jul/29 https://github.com/hashicorp/vagrant-plugin-changelog/blob/master/vagrant-vmware-changelog.md https://www.exploit-db.com/exploits/42334/ https://m4.rkw.io/blog/cve20177642-local-root-privesc-in-hashicorp-vagrantvmwarefusion--4020.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-16873`	vulnerable	2026-06-08 05:09:07.491043	Details available It is possible to exploit an unsanitized PATH in the suid binary that ships with vagrant-vmware-fusion 4.0.25 through 5.0.4 in order to escalate to root privileges. Published: 2018-03-29T22:00:00.000Z Updated: 2024-08-05T20:35:21.259Z Open on db.gcve.eu Reference links https://m4.rkw.io/blog/cve201716873-hashicorp-vagrantvmwarefusion-v4025504-local-root.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-16512`	vulnerable	2026-06-08 05:09:00.448325	Details available The vagrant update process in Hashicorp vagrant-vmware-fusion 5.0.2 through 5.0.4 allows local users to steal root privileges via a crafted update request when no updates are available. Published: 2018-03-29T22:00:00.000Z Updated: 2024-08-05T20:27:04.059Z Open on db.gcve.eu Reference links https://m4.rkw.io/blog/cve201716512-hashicorp-vagrantvmwarefusion-v502504-local-root.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-12579`	vulnerable	2026-06-08 05:08:47.072821	Details available An insecure suid wrapper binary in the HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) 4.0.24 and earlier allows a non-root user to obtain a root shell. Published: 2017-10-19T13:00:00.000Z Updated: 2024-08-05T18:43:56.039Z Open on db.gcve.eu Reference links https://m4.rkw.io/blog/cve201712579-local-root-privesc-in-hashicorp-vagrantvmwarefusion-4024.html https://www.exploit-db.com/exploits/43223/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-11741`	vulnerable	2026-06-08 05:08:38.375703	Details available HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) before 4.0.24 uses weak permissions for the sudo helper scripts, allows local users to execute arbitrary code with root privileges by overwriting one of the scripts. Published: 2017-08-08T19:00:00.000Z Updated: 2024-08-05T18:19:38.970Z Open on db.gcve.eu Reference links http://seclists.org/fulldisclosure/2017/Aug/0 https://www.exploit-db.com/exploits/43224/ https://m4.rkw.io/blog/cve201711741-local-root-privesc-in-hashicorp-vagrantvmwarefusion--4023.html	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.