Lucene search

[email protected]CVE-2018-6970

HistoryAug 13, 2018 - 9:48 p.m.

CVE-2018-6970

2018-08-1321:48:02

CWE-125

[email protected]

web.nvd.nist.gov

764

cve-2018-6970

vmware

horizon

out-of-bounds read

vulnerability

security

nvd

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

6 Medium

AI Score

Confidence

High

4 Medium

CVSS2

Access Vector

Access Complexity

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

0.003 Low

EPSS

Percentile

70.5%

JSON

VMware Horizon 6 (6.x.x before 6.2.7), Horizon 7 (7.x.x before 7.5.1), and Horizon Client (4.x.x and prior before 4.8.1) contain an out-of-bounds read vulnerability in the Message Framework library. Successfully exploiting this issue may allow a less-privileged user to leak information from a privileged process running on a system where Horizon Connection Server, Horizon Agent or Horizon Client are installed. Note: This issue doesn’t apply to Horizon 6, 7 Agents installed on Linux systems or Horizon Clients installed on non-Windows systems.

Affected configurations

NVD

Node

vmwarehorizon_clientRange4.0.0–4.8.1

vmwarehorizon_viewRange6.0.0–6.2.7

vmwarehorizon_viewRange7.0.0–7.5.1

CPENameOperatorVersion
vmware:horizon_clientvmware horizon clientlt4.8.1
vmware:horizon_viewvmware horizon viewlt6.2.7
vmware:horizon_viewvmware horizon viewlt7.5.1

CPE	Name	Operator	Version
vmware:horizon_client	vmware horizon client	lt	4.8.1
vmware:horizon_view	vmware horizon view	lt	6.2.7
vmware:horizon_view	vmware horizon view	lt	7.5.1

CNA Affected

[
  {
    "product": "VMware Horizon 6, Horizon 7, and Horizon Client",
    "vendor": "VMware",
    "versions": [
      {
        "status": "affected",
        "version": "VMware Horizon 6 (6.x.x before 6.2.7), Horizon 7 (7.x.x before 7.5.1), and Horizon Client (4.x.x and prior before 4.8.1)"
      }
    ]
  }
]