VMwareVMSA-2020-0023.3VMware ESXi, Workstation, Fusion and NSX-T updates address multiple security vulnerabilities (CVE-2020-3981, CVE-2020-3982, CVE-2020-3992, CVE-2020-3993, CVE-2020-3994, CVE-2020-3995)
3a. ESXi OpenSLP remote code execution vulnerability (CVE-2020-3992)
OpenSLP as used in ESXi has a use-after-free issue. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8.
3b. NSX-T MITM vulnerability (CVE-2020-3993)
VMware NSX-T contains a security vulnerability that exists in the way it allows a KVM host to download and install packages from NSX manager. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 7.5.
3c. TOCTOU out-of-bounds read vulnerability (CVE-2020-3981)
VMware ESXi, Workstation and Fusion contain an out-of-bounds read vulnerability due to a time-of-check time-of-use issue in ACPI device. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 7.1.
3d. TOCTOU out-of-bounds write vulnerability (CVE-2020-3982)
VMware ESXi, Workstation and Fusion contain an out-of-bounds write vulnerability due to a time-of-check time-of-use issue in ACPI device. VMware has evaluated the severity of this issue to be in the Moderate severity range with a maximum CVSSv3 base score of 5.9.
3e. vCenter Server session hijack vulnerability in update function (CVE-2020-3994)
VMware vCenter Server contains a session hijack vulnerability in the vCenter Server Appliance Management Interface update function due to a lack of certificate validation. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 7.5.
3f. VMCI host driver memory leak vulnerability (CVE-2020-3995)
The VMCI host drivers used by VMware hypervisors contain a memory leak vulnerability. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 7.1.
References
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-3981
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-3982
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-3992
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-3993
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-3994
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-3995
docs.vmware.com/en/VMware-Cloud-Foundation/3.10.1/rn/VMware-Cloud-Foundation-3101-Release-Notes.html#3.10.1.1
docs.vmware.com/en/VMware-Cloud-Foundation/3.10.1/rn/VMware-Cloud-Foundation-3101-Release-Notes.html#3.10.1.2
docs.vmware.com/en/VMware-Cloud-Foundation/4.1/rn/VMware-Cloud-Foundation-41-Release-Notes.html
docs.vmware.com/en/VMware-Cloud-Foundation/4.1/rn/VMware-Cloud-Foundation-41-Release-Notes.html#4.1.0.1
docs.vmware.com/en/VMware-Fusion/index.html
docs.vmware.com/en/VMware-NSX-T-Data-Center/index.html
docs.vmware.com/en/VMware-vSphere/6.5/rn/esxi650-202011001.html
docs.vmware.com/en/VMware-vSphere/6.7/rn/esxi670-202011001.html
docs.vmware.com/en/VMware-vSphere/7.0/rn/vsphere-esxi-70u1a.html
docs.vmware.com/en/VMware-Workstation-Player/index.html
docs.vmware.com/en/VMware-Workstation-Pro/index.html
my.vmware.com/en/web/vmware/downloads/details?downloadGroup=NSX-T-2522&productId=673&rPId=53876
my.vmware.com/en/web/vmware/downloads/details?downloadGroup=NSX-T-302&productId=982&rPId=52624
my.vmware.com/en/web/vmware/downloads/details?downloadGroup=VC65U3K&productId=614&rPId=50173
my.vmware.com/group/vmware/patch
my.vmware.com/web/vmware/downloads/details?downloadGroup=VC67U3&productId=742&rPId=52126
my.vmware.com/web/vmware/downloads/details?downloadGroup=VCF390&productId=945&rPId=41516
www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N
www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
www.vmware.com/go/downloadfusion
www.vmware.com/go/downloadplayer
www.vmware.com/go/downloadworkstation
Related
