CVE-2019-5534

VMware vCenter Server 6.7.x prior to 6.7 U3, 6.5 prior to 6.5 U3 and 6.0 prior to 6.0 U3j contains an information disclosure vulnerability where Virtual Machines deployed from an OVF could expose login information via the virtual machine's vAppConfig properties. A malicious actor with access to...

CVE-2019-5531: Insufficient Session Expiration

VMware vSphere ESXi 6.7 prior to ESXi670-201810101-SG, 6.5 prior to ESXi650-201811102-SG, and 6.0 prior to ESXi600-201807103-SG and VMware vCenter Server 6.7 prior to 6.7 U1b, 6.5 prior to 6.5 U2b, and 6.0 prior to 6.0 U3j contain an information disclosure vulnerability in clients arising from...

CVE-2019-5532: Insertion of Sensitive Information into Log File

VMware vCenter Server 6.7.x prior to 6.7 U3, 6.5 prior to 6.5 U3 and 6.0 prior to 6.0 U3j contains an information disclosure vulnerability due to the logging of credentials in plain-text for virtual machines deployed through OVF. A malicious user with access to the log files containing vCenter...

VMSA-2019-0013 : Command injection and information disclosure vulnerabilities

a. VMware ESXi busybox command injection vulnerability ESXi contains a command injection vulnerability due to the use of vulnerable version of busybox that does not sanitize filenames which may result into executing any escape sequence in the shell. An attacker may exploit this issue by tricking ...

CVE-2019-5534: Exposure of Sensitive Information to an Unauthorized Actor

VMware vCenter Server 6.7.x prior to 6.7 U3, 6.5 prior to 6.5 U3 and 6.0 prior to 6.0 U3j contains an information disclosure vulnerability where Virtual Machines deployed from an OVF could expose login information via the virtual machine's vAppConfig properties. A malicious actor with access to...

AMD Radeon Graphics Cards Open VMware Workstations to Attack

A remote code-execution bug exists in some configurations of the AMD Radeon graphics card that could allow an attacker to take control of a targeted system. The hack entails luring users of vulnerable systems to visit a specially crafted website that can deliver “a malformed pixel shader” to eith...

Vulnerability Spotlight: AMD ATI Radeon ATIDXX64.DLL shader functionality remote code execution vulnerability

Piotr Bania of Cisco Talos discovered this vulnerability. Some AMD Radeon cards contain a remote code execution vulnerability in their ATIDXX64.DLL driver. AMD produces the Radeon line of hardware, which includes graphics cards and graphics processing units. This specific vulnerability exists on...

VMware Releases Security Updates for Multiple Products

VMware has released security updates to address vulnerabilities in ESXi and vCenter. An attacker could exploit some of these vulnerabilities to take control of an affected system. The Cybersecurity and Infrastructure Security Agency CISA encourages users and administrators to review VMware Securi...

VMSA-2019-0014:VMware ESXi, Workstation, Fusion, VMRC and Horizon Client updates address use-after-free and denial of service vulnerabilities.

VMware Security Advisories Advisory ID| VMSA-2019-0014.1 ---|--- Advisory Severity| Important CVSSv3 Range| 4.7-8.5 Synopsis| VMware ESXi, Workstation, Fusion, VMRC and Horizon Client updates address use-after-free and denial of service vulnerabilities. CVE-2019-5527, CVE-2019-5535 Issue Date|...

AMD ATI Radeon ATIDXX64.DLL shader functionality remote code execution vulnerability

Summary An exploitable memory corruption vulnerability exists in AMD ATIDXX64.DLL driver, versions 25.20.15031.5004 and 25.20.15031.9002. A specially crafted pixel shader can cause an out-of-bounds memory write. An attacker can provide a specially crafted shader file to trigger this vulnerability...

VMware ESXi and vCenter Server updates address command injection and information disclosure vulnerabilities. (CVE-2017-16544, CVE-2019-5531, CVE-2019-5532, CVE-2019-5534)

3a. VMware ESXi 'busybox' command injection vulnerability- CVE-2017-16544 ESXi contains a command injection vulnerability due to the use of vulnerable version of busybox that does not sanitize filenames which may result into executing any escape sequence in the shell. VMware has evaluated the...

PT-2019-4336

Name of the Vulnerable Software and Affected Versions VMware vCenter Server versions 6.0 prior to 6.0 U3j VMware vCenter Server versions 6.5 prior to 6.5 U3 VMware vCenter Server versions 6.7.x prior to 6.7 U3 Description The issue is related to insufficient protection of registration data in the...

PT-2019-4333

Name of the Vulnerable Software and Affected Versions VMware vSphere ESXi versions 6.7 prior to ESXi670-201810101-SG VMware vSphere ESXi versions 6.5 prior to ESXi650-201811102-SG VMware vSphere ESXi versions 6.0 prior to ESXi600-201807103-SG VMware vCenter Server versions 6.7 prior to 6.7 U1b...

PT-2019-4334

Name of the Vulnerable Software and Affected Versions VMware vCenter Server versions 6.7.x prior to 6.7 U3 VMware vCenter Server version 6.5 prior to 6.5 U3 VMware vCenter Server version 6.0 prior to 6.0 U3j Description The issue is related to the logging of credentials in plain-text for virtual...

AMD ATIDXX64.DLL Memory Corruption Vulnerability

AMD ATIDXX64.DLL is a driver from AMD. A memory corruption vulnerability exists in AMD ATIDXX64.DLL versions 25.20.15031.5004 and 25.20.15031.9002 running on Radeon RX 550 / 550 Series VMware Workstation 15 15.0.4 build-12990004 versions. A memory corruption vulnerability exists in VMware...

VMSA-2019-0013:VMware ESXi and vCenter Server updates address command injection and information disclosure vulnerabilities.

VMware Security Advisories Advisory ID| VMSA-2019-0013.1 ---|--- Advisory Severity| Important CVSSv3 Range| 4.2-7.7 Synopsis| VMware ESXi and vCenter Server updates address command injection and information disclosure vulnerabilities. CVE-2017-16544, CVE-2019-5531, CVE-2019-5532, CVE-2019-5534...

VMware ESXi hostd supervisor Partial DoS

The vulnerability of the VMware ESXi hypervisor’s host service exists due to errors in system call filtering. Exploiting this vulnerability can allow a malicious actor to cause partial service failure remotely...

Important: Red Hat Security Advisory: kernel security and bug fix update

An update for kernel is now available for Red Hat Enterprise Linux 7.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

Photon OS 2.0: Patch PHSA-2019-2.0-0172

An update of the patch package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2019-2.0-0172. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid128712...

Photon OS 2.0: Ansible PHSA-2019-2.0-0172

An update of the ansible package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2019-2.0-0172. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...