VMware vCenter Server Patch Reissue

VMware on Saturday reissued a patch from October that incompletely addressed a critically rated remote code execution vulnerability in vCenter Server. The original vulnerability, CVE-2015-2342, was a poorly configured JMX RMI service in vCenter Server that was remotely accessible. The flaw allowe...

ESXi 5.1 < Build 3070626 Shared Folders (HGFS) Guest Privilege Escalation (VMSA-2016-0001) (remote check)

The remote VMware ESXi 5.1 host is prior to build 3070626. It is, therefore, affected by a guest privilege escalation vulnerability in the Shared Folders HGFS feature due to improper validation of user-supplied input. A local attacker can exploit this to corrupt memory, resulting in an elevation ...

ESXi 6.0 < Build 3380124 Shared Folders (HGFS) Guest Privilege Escalation (VMSA-2016-0001) (remote check)

The remote VMware ESXi 6.0 host is prior to build 3380124. It is, therefore, affected by a guest privilege escalation vulnerability in the Shared Folders HGFS feature due to improper validation of user-supplied input. A local attacker can exploit this to corrupt memory, resulting in an elevation ...

ESXi 5.5 < Build 3248547 Shared Folders (HGFS) Guest Privilege Escalation (VMSA-2016-0001) (remote check)

The remote VMware ESXi 5.5 host is prior to build 3248547. It is, therefore, affected by a guest privilege escalation vulnerability in the Shared Folders HGFS feature due to improper validation of user-supplied input. A local attacker can exploit this to corrupt memory, resulting in an elevation ...

ESXi 5.0 < Build 3086167 Shared Folders (HGFS) Guest Privilege Escalation (VMSA-2016-0001) (remote check)

The remote VMware ESXi 5.0 host is prior to build 3086167. It is, therefore, affected by a guest privilege escalation vulnerability in the Shared Folders HGFS feature due to improper validation of user-supplied input. A local attacker can exploit this to corrupt memory, resulting in an elevation ...

VMware ESXi updates address important guest privilege escalation vulnerability (VMSA-2016-0001) - Remote Version Check

VMware ESXi updates address important guest privilege escalation vulnerability SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

VMware ESXi updates address important guest privilege escalation vulnerability (VMSA-2016-0001)

VMware ESXi updates address important guest privilege escalation vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2015-6933

CVE-2015-6933 affects VMware Tools HGFS across VMware Workstation (11.x prior to 11.1.2), VMware Player (7.x prior to 7.1.2), VMware Fusion (7.x prior to 7.1.2), and VMware ESXi (5.0–6.0). Root cause: HGFS/shared folders component vulnerability leading to guest OS privilege escalation or guest ke...

VMware Releases Security Updates

VMware has released security updates to address a vulnerability in VMware ESXi, Fusion, Player, and Workstation. Exploitation of this vulnerability may allow escalation of privileges. US-CERT encourages users and administrators to review VMware Security Advisory VMSA-2016-0001 and apply the...

VMware ESXi Multiple OpenSSL Vulnerabilities (VMSA-2014-0006)

The remote VMware ESXi host is affected by multiple vulnerabilities in the OpenSSL third-party library : - A use-after-free error exists in the ssl3readbytes function in file ssl/s3pkt.c that is triggered when a second read is done to the function by multiple threads when SSLMODERELEASEBUFFERS is...

VMware ESXi Multiple OpenSSL Vulnerabilities (VMSA-2014-0004) (Heartbleed)

The remote VMware ESXi host is affected by multiple vulnerabilities in the OpenSSL third-party library : - A flaw exist in the Elliptic Curve Digital Signature Algorithm ECDSA implementation due to a failure to ensure that certain swap operations have a constant-time behavior. An attacker can...

VMware ESX / ESXi Multiple DoS (VMSA-2014-0001)

The remote VMware ESX / ESXi host is affected by multiple denial of service vulnerabilities : - A denial of service vulnerability exists due to a NULL pointer deference flaw when handling Network File Copy NFC traffic. An unauthenticated, remote attacker can exploit this by intercepting and...

VMware ESXi Tools Guest OS Privilege Escalation (VMSA-2014-0005)

The remote VMware ESXi host is affected by a privilege escalation vulnerability due to a NULL pointer dereference flaw in VMware Tools running on Microsoft Windows 8.1. An attacker on an adjacent network can exploit this issue to gain elevated privileges within the guest operating system or else...

VMware ESX / ESXi vSphere Client RCE (VMSA-2014-0003)

The remote VMware ESX / ESXi host is affected by a remote code execution vulnerability in the vSphere Client versions 4.0 / 4.1 due to improper validation of updates to client files. An unauthenticated, remote attacker can exploit this, via a malicious link, to download and execute arbitrary code...

VMware ESXi Multiple DoS (VMSA-2014-0008)

The remote ESXi host is affected by multiple denial of service vulnerabilities in the glibc library : - A buffer overflow condition exists in the extendbuffers function in file posix/regexec.c due to improper validation of user-supplied input when handling multibyte characters in a regular...

VMware ESX / ESXi Multiple Vulnerabilities (VMSA-2014-0002)

The remote VMware ESX / ESXi host is affected by multiple vulnerabilities : - Multiple integer overflow conditions exist in the glibc package in file malloc/malloc.c. An unauthenticated, remote attacker can exploit these to cause heap memory corruption by passing large values to the pvalloc,...

VMware ESXi Multiple Vulnerabilities (VMSA-2014-0012)

The remote VMware ESXi host is affected by multiple vulnerabilities : - Multiple denial of service vulnerabilities exist in Python function readstatus in library httplib and in function readline in libraries smtplib, ftplib, nntplib, imaplib, and poplib. A remote attacker can exploit these...

VMware ESXi 5.0 < Build 3021432 OpenSLP RCE (VMSA-2015-0007)

The remote VMware ESXi host is version 5.0 prior to build 3021432. It is, therefore, affected by a remote code execution vulnerability due to a double-free error in the SLPDProcessMessage function in OpenSLP. An unauthenticated, remote attacker can exploit this, via a crafted package, to execute...

VMware ESXi 5.1 < Build 3021178 OpenSLP RCE (VMSA-2015-0007)

The remote VMware ESXi host is version 5.1 prior to build 3021178. It is, therefore, affected by a remote code execution vulnerability due to a double-free error in the SLPDProcessMessage function in OpenSLP. An unauthenticated, remote attacker can exploit this, via a crafted package, to execute...

VMware ESXi 5.5 < Build 3029944 OpenSLP RCE (VMSA-2015-0007)

The remote VMware ESXi host is version 5.5 prior to build 3029944. It is, therefore, affected by a remote code execution vulnerability due to a double-free error in the SLPDProcessMessage function in OpenSLP. An unauthenticated, remote attacker can exploit this, via a crafted package, to execute...