ESXi 6.5 / 6.7 / 7.0 Multiple Vulnerabilities (VMSA-2020-0026)

According to its self-reported version number, the remote VMware ESXi host is version 6.5, 6.7 or 7.0 and is affected by multiple vulnerabilities. - A use-after-free error exists in the XHCI USB controller. An unauthenticated, local attacker with local administrative privileges on a virtual machi...

VMware Fusion 11.x < 11.5.7 Use-after-free (VMSA-2020-0026)

The version of VMware Fusion installed on the remote macOS or Mac OS X host is 11.x prior to 11.5.7. It is, therefore, affected by a use-after-free error in the XHCI USB Controller. An unauthenticated, local attacker with administrative privileges on a virtual machine may exploit this issue to...

VMware Workstation 15.x < 15.5.7 Use-after-free (VMSA-2020-0026)

The version of VMware Workstation installed on the remote Windows host is 15.x prior to 15.5.7. It is, therefore, affected by a use-after-free error in the XHCI USB Controller. An unauthenticated, local attacker with administrative privileges on a virtual machine may exploit this issue to execute...

VMSA-2020-0026 : VMware ESXi, Workstation and Fusion updates address use-after-free and privilege escalation vulnerabilities

a. Use-after-free vulnerability in XHCI USB controller CVE-2020-4004 VMware ESXi contains a use-after-free vulnerability in the XHCI USB controller. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machines VMX proce...

CVE-2020-4004

VMware ESXi 7.0 before ESXi70U1b-17168206, 6.7 before ESXi670-202011101-SG, 6.5 before ESXi650-202011301-SG, Workstation 15.x before 15.5.7, Fusion 11.x before 11.5.7 contain a use-after-free vulnerability in the XHCI USB controller. A malicious actor with local administrative privileges on a...

CVE-2020-4004

VMware ESXi 7.0 before ESXi70U1b-17168206, 6.7 before ESXi670-202011101-SG, 6.5 before ESXi650-202011301-SG, Workstation 15.x before 15.5.7, Fusion 11.x before 11.5.7 contain a use-after-free vulnerability in the XHCI USB controller. A malicious actor with local administrative privileges on a...

Design/Logic Flaw

VMware ESXi 7.0 before ESXi70U1b-17168206, 6.7 before ESXi670-202011101-SG, 6.5 before ESXi650-202011301-SG, Workstation 15.x before 15.5.7, Fusion 11.x before 11.5.7 contain a use-after-free vulnerability in the XHCI USB controller. A malicious actor with local administrative privileges on a...

CVE-2020-4004

VMware ESXi 7.0 before ESXi70U1b-17168206, 6.7 before ESXi670-202011101-SG, 6.5 before ESXi650-202011301-SG, Workstation 15.x before 15.5.7, Fusion 11.x before 11.5.7 contain a use-after-free vulnerability in the XHCI USB controller. A malicious actor with local administrative privileges on a...

CVE-2020-4004

CVE-2020-4004 is a use-after-free in the XHCI USB controller affecting VMware ESXi (7.0 before ESXi70U1b-17168206; 6.7 before ESXi670-202011101-SG; 6.5 before ESXi650-202011301-SG), VMware Workstation (15.x before 15.5.7), and VMware Fusion (11.x before 11.5.7). The underlying issue allows a mali...

VMware ESXi Resource Management Error Vulnerability

Vmware VMware ESXi is a server virtualization platform from Vmware that can be installed directly on physical servers. A security vulnerability exists in VMware ESXi that stems from the inclusion of a no after-use vulnerability in the XHCI USB controller. A malicious participant with local...

UBUNTU-CVE-2020-25723

A reachable assertion issue was found in the USB EHCI emulation code of QEMU. It could occur while processing USB requests due to missing handling of DMA memory map failure. A malicious privileged user within the guest may abuse this flaw to send bogus USB requests and crash the QEMU process on t...

CVE-2020-25084

A use-after-free flaw was found in the USBxHCI/eHCI controller emulators of QEMU. This flaw occurs while setting up the USB packet as a usbpacketmap routine and returns an error that was not checked. This flaw allows a guest user or process to crash the QEMU process, resulting in a denial of...

The vulnerability of the USB 3.0 (xHCI) controller in VMware ESXi, VMware Workstation, and VMware Fusion allows a attacker to cause a service failure or execute arbitrary code.

The vulnerability of the USB 3.0 xHCI controller in VMware ESXi, VMware Workstation, and VMware Fusion lies in the writing of data beyond the buffer boundaries. Exploiting this vulnerability can allow an attacker to cause a service failure or execute arbitrary code...

Information Disclosure Vulnerability in Multiple VMware Products (CNVD-2021-24358)

VMware ESXi is a server virtualization platform that can be installed directly on physical servers, VMware Workstation is a set of virtual machine software, and VMware Fusion is a set of virtual machine software designed to run Windows applications on Macs. VMware Fusion is a suite of virtual...

Information Disclosure Vulnerability in Multiple VMware Products (CNVD-2021-24359)

VMware ESXi is a server virtualization platform that can be installed directly on physical servers, VMware Workstation is a set of virtual machine software, and VMware Fusion is a set of virtual machine software designed to run Windows applications on Macs. VMware Fusion is a suite of virtual...

Multiple VMware Products Competitive Conditions Issue Vulnerability

VMware ESXi is a server virtualization platform that can be installed directly on physical servers, VMware Workstation is a set of virtual machine software, and VMware Fusion is a set of virtual machine software designed to run Windows applications on Macs. VMware Fusion is a suite of virtual...

CVE-2020-3964

VMware ESXi 7.0 before ESXi7.0.0-1.20.16321839, 6.7 before ESXi670-202006401-SG and 6.5 before ESXi650-202005401-SG, Workstation 15.x before 15.5.2, and Fusion 11.x before 11.5.2 contain an information leak in the EHCI USB controller. A malicious actor with local access to a virtual machine may b...

CVE-2020-3965

VMware ESXi 7.0 before ESXi7.0.0-1.20.16321839, 6.7 before ESXi670-202006401-SG and 6.5 before ESXi650-202005401-SG, Workstation 15.x before 15.5.2, and Fusion 11.x before 11.5.2 contain an information leak in the XHCI USB controller. A malicious actor with local access to a virtual machine may b...

CVE-2020-3966

VMware ESXi 7.0 before ESXi7.0.0-1.20.16321839, 6.7 before ESXi670-202004101-SG and 6.5 before ESXi650-202005401-SG, Workstation 15.x before 15.5.2, and Fusion 11.x before 11.5.2 contain a heap-overflow due to a race condition issue in the USB 2.0 controller EHCI. A malicious actor with local...

CVE-2020-3967

VMware ESXi 7.0 before ESXi7.0.0-1.20.16321839, 6.7 before ESXi670-202004101-SG and 6.5 before ESXi650-202005401-SG, Workstation 15.x before 15.5.5, and Fusion 11.x before 11.5.5 contain a heap-overflow vulnerability in the USB 2.0 controller EHCI. A malicious actor with local access to a virtual...