Description

Some vulnerabilities have been reported in multiple VMware products, which can be exploited by malicious people to conduct cross-site scripting attacks, cause a DoS (Denial of Service), or compromise a vulnerable system.

1) Multiple vulnerabilities in libpng and Apache can be exploited by malicious people to conduct cross-site scripting attacks, cause a DoS (Denial of Service), or potentially compromise a vulnerable system.

For more information:
SA26636
SA26273
SA28081
SA33970

2) Two vulnerabilities in the VMnc codec (vmnc.dll) can be exploited to corrupt memory and potentially execute arbitrary code.

For more information:
SA34938

The vulnerabilities are reported in the following products and versions:
* VMware Workstation 6.5.2 and earlier
* VMware Player 2.5.2 and earlier
* VMware ACE 2.5.2 and earlier

Solution
-- VMware Workstation --
Further details available to Secunia VIM customers

Changelog
Further details available to Secunia VIM customers

Original Advisory
VMSA-2009-0010:
http://lists.vmware.com/pipermail/security-announce/2009/000062.html

VMSA-2009-0012:
http://lists.vmware.com/pipermail/security-announce/2009/000065.html

Other references
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers