Description: Multiple vulnerabilities were reported in Cisco WebEx Player. A remote user can cause arbitrary code to be executed on the target user's system. A remote user can cause denial of service conditions.
A remote user can create a specially crafted Advanced Recording Format (ARF) or WebEx Recording Format (WRF) file that, when loaded by the target user, will execute arbitrary code on the target system [CVE-2017-12368, CVE-2017-12369, CVE-2017-12370, CVE-2017-12371, CVE-2017-12372]. The code will run with the privileges of the target user.
A remote user can create a specially crafted ARF or WRF file that, when loaded by the target user, will cause the target user's player to crash [CVE-2017-12367].
CSCvg54856CSCvg54861, CSCvg54861CSCvg54867, CSCvg54867CSCvg54868, CSCvg54868CSCvg54870, and CSCvg54870 to these vulnerabilities.
Yihan Lian, Kushal Arvind Shah of Fortinet's Fortiguard Team, Steven Seeley of Offensive Security working (via Trend Micro's Zero Day Initiative), and rgod (via Trend Micro's Zero Day Initiative) reported these vulnerabilities.
A remote user can create content that, when loaded by the target user, will cause denial of service conditions on the target user's system.