Software Update: VMware Workstation Player 15.0.3

VMware has released the third update for version 15 Workstation Player. Player is free software to create and run virtual machines. However, a fee is charged for commercial use. Simply put, it is a simplified implementation of other VMware products, such as Workstation Pro, Server, and ESX Server. Microsoft Virtual PC virtual machines and Symantec LiveState Recovery disks are also supported. In addition, several pre-installed virtual machines can be installed via this page are downloaded, such as Debian, Ubuntu, and Fedora. In version 15.0.3 some security vulnerabilities have been fixed and the OpenSSL and libxml2 libraries have been updated to a newer version.

Important Fixes:

• VMware Workstation Player contained elevation of privilege vulnerabilities:
  • Workstation Player does not handle paths appropriately. This may allow the path to the VMX executable, on a Windows host, to be hijacked by a non-administrator leading to elevation of privilege. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the identifier CVE-2019-5511 to this issue. see VMSA-2019-0002 for further information.
  • COM classes are not handled appropriately. This may allow hijacking of COM classes used by the VMX process, on a Windows host, leading to elevation of privilege. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the identifier CVE-2019-5512 to this issue. see VMSA-2019-0002 for further information.
• Updated OpenSSL library version to 1.0.2q.
• Updated libxml2 library version to 2.9.9.