VMware Player 2.0.5

虛擬機器是以軟體定義的電腦，就像是在你的個人電腦上再跑一台個人電腦。

這款免費的桌面虛擬化軟體應用程式，讓你可以輕鬆操作任何由 VMware Workstation、VMware Fusion、VMware Server 或 VMware ESX 建立的虛擬機器。

主要功能包括：

• 在單一 PC 上同時執行多個作業系統。
• 體驗預先設定好的產品所帶來的便利，無需處理任何安裝或設定問題。
• 在主機電腦與虛擬機器之間共享資料。
• 支援執行 32 位元與 64 位元的虛擬機器。
• 善用雙向虛擬 SMP（對稱多處理）。
• 可使用第三方虛擬機器與映像檔。
• 在主機電腦與虛擬機器之間共享資料。
• 廣泛支援主機與客座作業系統。
• 支援 USB 2.0 裝置。
• 啟動時即可取得應用裝置資訊。
• 透過直觀的首頁介面輕鬆存取虛擬機器。

VMware Player 也支援 Microsoft Virtual Server 虛擬機器或 Microsoft Virtual PC 虛擬機器。

Player 2.0.5 addresses the following security issues:

* Setting ActiveX killbit
Starting from this release, VMware has set the killbit on its ActiveX controls. Setting the killbit ensures that ActiveX controls cannot run in Internet Explorer (IE), and avoids security issues involving ActiveX controls in IE. See the KB article 240797 available from Microsoft and the related references on this topic.
Security vulnerabilities have been reported for ActiveX controls provided by VMware when run in IE. Under specific circumstances, exploitation of these ActiveX controls might result in denial-of-service or allow running of arbitrary code when the user browses a malicious Web site or opens a malicious file in IE browser. An attempt to run unsafe ActiveX controls in Internet Explorer might result in pop-up windows warning the user.
Note: IE can be configured to run unsafe ActiveX controls without prompting. VMware recommends that you retain the default settings in IE, which prompts when unsafe actions are requested.
Earlier, VMware had issued knowledge base articles, KB 5965318 and KB 9078920 on security issues with ActiveX controls.
To avoid malicious scripts that exploit ActiveX controls, do not enable unsafe ActiveX objects in your browser settings. As a best practice, do not browse untrusted Web sites as an administrator and do not click OK or Yes if prompted by IE to allow certain actions.
The Common Vulnerabilities and Exposures has assigned the names CVE-2008-3691, CVE-2008-3692, CVE-2008-3693, CVE-2008-3694, CVE-2008-3695, CVE-2007-5438, and CVE-2008-3696 to the security issues with VMware ActiveX controls.

* Update to FreeType
FreeType 2.3.6 resolves an integer overflow vulnerability and other vulnerabilities that can allow malicious users to run arbitrary code or might cause a denial-of-service after reading a maliciously crafted file. This release updates FreeType to its latest version 2.3.7.
The Common Vulnerabilities and Exposures has assigned the names CVE-2008-1806, CVE-2008-1807, and CVE-2008-1808 to the issues resolved in FreeType 2.3.6.

* Update to Cairo
Cairo 1.4.12 resolves an integer overflow vulnerability that can allow malicious users to run arbitrary code or might cause a denial-of-service after reading a maliciously crafted PNG file. This release updates Cairo to its latest version 1.4.14. The Common Vulnerabilities and Exposures has assigned the name CVE-2007-5503 to the issue resolved in Cairo 1.4.12.