Some vulnerabilities have been reported in multiple VMware products, which can be exploited by malicious, local users to disclose sensitive information or gain escalated privileges, and by malicious people to disclose sensitive information, cause a DoS (Denial of Service), or potentially compromise a user's system.

1) Two errors in the VMware Tools package for Windows can be exploited to execute arbitrary code or potentially gain escalated privileges.

For more information:
SA39198

2) An error in the USB service can be exploited to gain escalated privileges on host systems by placing a malicious executable at a certain location on the host.

NOTE: This vulnerability cannot be exploited without administrative privileges on recent Windows versions (e.g. Windows XP and Windows Vista).

3) An error in libpng can be exploited to disclose uninitialised memory via a specially crafted image.

For more information:
SA35346

4) A boundary error and two integer truncation errors in the VMnc codec can be exploited to potentially execute arbitrary code.

For more information:
SA36712

5) An error in the VMware Authorization Service ("vmware-authd") can be exploited to cause a crash.

For more information:
SA36988

6) An error in the virtual networking stack can be exploited to disclose potentially sensitive information.

For more information:
SA39203

7) A format string error in "vmrun" can be exploited to potentially gain escalated privileges.

For more information:
SA39201

Solution
Update to a fixed version.
Further details available to Secunia VIM customers

Provided and/or discovered by
4) Alin Rad Pop, Secunia Research

The vendor also credits:
1) Jure Skofic and Mitja Kolsek of ACROS Security
2) Thierry Zoller
4) iDefense and Sebastien Renaud of Vupen
6) Johann MacDonagh
7) Thomas Toth-Steiner

Original Advisory
VMware (VMSA-2010-0007):
http://lists.vmware.com/pipermail/security-announce/2010/000090.html

Secunia Research:
http://secunia.com/secunia_research/2009-36/
http://secunia.com/secunia_research/2009-37/

Other references
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers