VMware vCenter Server, Orchestrator, Update Manager, vShield, vSphere Client, ESXi and ESX address several security issues

a. VMware Tools Display Driver Privilege Escalation The VMware XPDM and WDDM display drivers contain buffer overflow vulnerabilities and the XPDM display driver does not properly check for NULL pointers. Exploitation of these issues may lead to local privilege escalation on Windows-based Guest...

VMSA-2011-0011:Hosted product updates address a remote code execution vulnerability in the way UDF file systems are handled

VMSA-2011-0011 VMware hosted products address remote code execution vulnerability VMware Security Advisory VMware Security Advisory Advisory ID: VMSA-2011-0011 VMware Security Advisory Synopsis: VMware hosted products address remote code execution vulnerability VMware Security Advisory Issue date...

Updated service console patches.

I Service Console package security updates...

VMSA-2023-0014:VMware vCenter Server updates address multiple memory corruption vulnerabilities

Advisory ID: VMSA-2023-0014 CVSSv3 Range: 5.9 - 8.1 Issue Date:2023-06-22 Updated On: 2023-06-22 Initial Advisory CVEs: CVE-2023-20892, CVE-2023-20893, CVE-2023-20894, CVE-2023-20895, CVE-2023-20896 Synopsis: VMware vCenter Server updates address multiple memory corruption vulnerabilities...

VMSA-2022-0026:VMware vRealize Operations patches address an arbitrary file read vulnerability

Advisory ID: VMSA-2022-0026 CVSSv3 Range: 4.9 Issue Date:2022-10-11 Updated On: 2022-10-11 Initial Advisory CVEs: CVE-2022-31682 Synopsis: VMware vRealize Operations patches address an arbitrary file read vulnerability CVE-2022-31682. RSS Feed Download PDF Download Text File Share this page on...

VMware product updates address critical and important security issues

a. Critical JMX issue when deserializing authentication credentials...

VMSA-2014-0009:VMware NSX and vCNS product updates address a CRITICAL information disclosure vulnerability.

VMSA-2014-0009 VMware NSX and vCNS product updates address a critical information disclosure vulnerability. VMware Security Advisory VMware Security Advisory Advisory ID: VMSA-2014-0009 VMware Security Advisory Synopsis: VMware NSX and vCNS product updates address a critical information disclosur...

VMware ESX, Workstation, Fusion, and View VMCI privilege escalation vulnerability

a. VMware VMCI privilege escalation VMware ESX, Workstation, Fusion, and View contain a vulnerability in the handling of control code in vmci.sys. A local malicious user may exploit this vulnerability to manipulate the memory allocation through the Virtual Machine Communication Interface VMCI cod...

VMware View Server directory traversal

a. VMware View Server directory traversalVMware View contains a critical directory traversal vulnerability that allows an unauthenticated remote attacker to retrieve arbitrary files from affected View Servers. Exploitation of this issue may expose sensitive information stored on the...

VMSA-2012-0003:VMware VirtualCenter Update and ESX 3.5 patch update JRE

VMSA-2012-0003.1 VMware VirtualCenter Update and ESX 3.5 patch update JRE VMware Security Advisory VMware Security Advisory Advisory ID: VMSA-2012-0003.1 VMware Security Advisory Synopsis: VMware VirtualCenter Update and ESX 3.5 patch update JRE VMware Security Advisory Issue date: 2012-03-08...

VMSA-2012-0002:VMware vCenter Chargeback Manager Information Leak and Denial of Service

VMSA-2012-0002 VMware vCenter Chargeback Manager Information Leak and Denial of Service VMware Security Advisory VMware Security Advisory Advisory ID: VMSA-2012-0002 VMware Security Advisory Synopsis: VMware vCenter Chargeback Manager Information Leak and Denial of Service VMware Security Advisor...

VMware ESX third party updates for Service Console

a. Service Console update for samba The service console package samba is updated to version 3.0.9-1.3E.18. The Common Vulnerabilities and Exposures project cve.mitre.org has assigned the name CVE-2010-3069 to this issue. Column 4 of the following table lists the action required to remediate the...

VMSA-2024-0003:Addressing Arbitrary Authentication Relay and Session Hijack Vulnerabilities in Deprecated VMware Enhanced Authentication Plug-in (EAP) (CVE-2024-22245, CVE-2024-22250)

Advisory ID: | VMSA-2024-0003 ---|--- CVSSv3 Range: | 9.6 - 7.8 Issue Date: | 2024-02-20 Updated On: | 2024-02-20 Initial Advisory CVEs: | CVE-2024-22245, CVE-2024-22250 Synopsis: | Addressing Arbitrary Authentication Relay and Session Hijack Vulnerabilities in Deprecated VMware Enhanced...

VMSA-2021-0019:VMware vRealize Log Insight updates address Cross Site Scripting (XSS) vulnerability

Advisory ID: VMSA-2021-0019 CVSSv3 Range: 6.5 Issue Date:2021-08-24 Updated On: 2021-08-24 Initial Advisory CVEs: CVE-2021-22021 Synopsis: VMware vRealize Log Insight updates address Cross Site Scripting XSS vulnerability CVE-2021-22021 RSS Feed Download PDF Download Text File Share this page on...

VMware Carbon Black App Control update addresses authentication bypass (CVE-2021-21998)

3. VMware Carbon Black App Control updates address authentication bypass CVE-2021-21998 The VMware Carbon Black App Control management server has an authentication bypass. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.4...

VMware Horizon Server and VMware Horizon Client updates address multiple security vulnerabilities (CVE-2020-3997, CVE-2020-3998)

3a. VMware Horizon Server Cross Site Scripting XSS vulnerability CVE-2020-3997 VMware Horizon Server does not correctly validate user input. VMware has evaluated the severity of this issue to be in the Moderate severity range with a maximum CVSSv3 base score of 4.1. 3b. VMware Horizon Client for...

VMware vCenter Server updates address sensitive information disclosure vulnerability in the VMware Directory Service (vmdir) (CVE-2020-3952)

3. VMware vCenter Server updates address sensitive information disclosure vulnerability in the VMware Directory Service vmdir CVE-2020-3952 Under certain conditions1 vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Services Controller PSC, does not correctl...

VMSA-2018-0031:vRealize Operations updates address a local privilege escalation vulnerability

VMSA-2018-0031 vRealize Operations updates address a local privilege escalation vulnerability VMware Security Advisory VMware Security Advisory Advisory ID: VMSA-2018-0031 VMware Security Advisory Severity: Important VMware Security Advisory Synopsis: vRealize Operations updates address a local...

VMware vSphere product updates address security vulnerabilities

a. VMware vCSA cross-site scripting vulnerabilityVMware vCenter Server Appliance vCSA contains a vulnerability that may allow for Cross Site Scripting. Exploitation of this vulnerability in vCenter Server requires tricking a user to click on a malicious link or to open a malicious web page. VMwar...

Updated aacraid driver and Samba and Python service console updates

I Updated ESX driver...

VMware vCenter Server updates address arbitrary file read and SSRF vulnerabilities (CVE-2021-21980, CVE-2021-22049)

3a. vCenter Server updates address arbitrary file read vulnerability in the vSphere Web Client CVE-2021-21980 The vSphere Web Client FLEX/Flash contains an unauthorized arbitrary file read vulnerability. VMware has evaluated the severity of this issue to be in the Important severity range with a...

VMSA-2021-0009:VMware Workstation and Horizon Client for Windows updates address multiple security vulnerabilities

Advisory ID: VMSA-2021-0009 CVSSv3 Range: 3.2 Issue Date:2021-05-20 Updated On: 2021-05-20 Initial Advisory CVEs: CVE-2021-21987, CVE-2021-21988, CVE-2021-21989 Synopsis: VMware Workstation and Horizon Client for Windows updates address multiple security vulnerabilities CVE-2021-21987,...

VMware Unified Access Gateway, Horizon View and Workstation updates resolve multiple security vulnerabilities

a. Unified Access Gateway and Horizon View heap buffer-overflow vulnerability VMware Unified Access Gateway and Horizon View contain a heap buffer-overflow vulnerability which may allow a remote attacker to execute code on the security gateway. VMware would like to thank Claudio Moletta redr2e fo...

VMSA-2012-0010:VMware vMA addresses a security issue

VMSA-2012-0010 VMware vMA addresses a security issue VMware Security Advisory VMware Security Advisory Advisory ID: VMSA-2012-0010 VMware Security Advisory Synopsis: VMware vMA addresses a security issue VMware Security Advisory Issue date: 2012-05-25 VMware Security Advisory Updated on: 2012-05-...

VMware ESX third party updates for Service Console

a. Service Console update for cpioThe service console package cpio is updated to version 2.5-6.RHEL3 for ESX 3.x versions and updated to version 2.6-23.el54.1 for ESX 4.x versions. The Common Vulnerabilities and Exposures project cve.mitre.org has assigned the names CVE-2005-4268 and CVE-2010-062...

VMSA-2008-0006:Updated libxml2 service console package

VMSA-2008-0006.1 Updated libxml2 service console package VMware Security Advisory VMware Security AdvisoryAdvisory ID: VMSA-2008-0006.1 VMware Security AdvisorySynopsis: Updated libxml2 service console package VMware Security AdvisoryIssue date: 2008-03-28 VMware Security AdvisoryUpdated on:...

VMSA-2024-0020:VMware NSX updates address multiple vulnerabilities (CVE-2024-38818, CVE-2024-38817, CVE-2024-38815)

Advisory ID: | VMSA-2024-0020 ---|--- Advisory Severity: | Moderate CVSSv3 Range: | 4.3-6.7 Synopsis: | VMware NSX updates address multiple vulnerabilities CVE-2024-38818, CVE-2024-38817, CVE-2024-38815 Issue date: | 2024-10-09 Updated on: | 2024-10-09 Initial Advisory CVEs | CVE-2024-38818,...

VMware Workspace ONE UEM console updates address an open redirect vulnerability (CVE-2023-20886)

3. Advisory Details VMware Workspace ONE UEM console contains an open redirect vulnerability. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 8.8...

VMware Cloud Foundation updates address multiple vulnerabilities.

3a. VMware Cloud Foundation update addresses a remote code execution vulnerability via XStream CVE-2021-39144 VMware Cloud Foundation contains a remote code execution vulnerability via XStream open source library. VMware has evaluated the severity of this issue to be in the Critical severity rang...

VMware vCenter Server updates address an information disclosure vulnerability (CVE-2022-22948)

3. vCenter Server information disclosure vulnerability CVE-2022-22948 The vCenter Server contains an information disclosure vulnerability due to improper permission of files. VMware has evaluated the severity of this issue to be in the Moderate severity range with a maximum CVSSv3 base score of...

VMSA-2019-0021:VMware Workstation and Fusion updates address multiple security vulnerabilities

VMware Security Advisories Advisory ID| VMSA-2019-0021 ---|--- Advisory Severity| Important CVSSv3 Range| 5.0-8.7 Synopsis| VMware Workstation and Fusion updates address multiple security vulnerabilities CVE-2019-5540, CVE-2019-5541, CVE-2019-5542 Issue Date| 2019-11-12 Updated On| 2019-11-12...

VMware vSphere product updates to third party libraries

a. vCenter Server Apache Struts Update The Apache Struts library is updated to address a security issue.This issue may lead to remote code execution after authentication.The Common Vulnerabilities and Exposures project cve.mitre.org has assigned the identifier CVE-2014-0114 to this issue.Column 4...

VMware Workstation, Player, ESXi and ESX patches address critical security issues

a. VMware host memory overwrite vulnerability data pointersDue to a flaw in the handler function for RPC commands, it is possible to manipulate data pointers within the VMX process. This vulnerability may allow a guest user to crash the VMX process or potentially execute code on the host.Workarou...

VMware ESX/ESXi SLPD denial of service vulnerability and ESX third party updates for Service Console packages bind, pam, and rpm.

a. Service Location Protocol daemon DoSThis patch fixes a denial-of-service vulnerability in the Service Location Protocol daemon SLPD. Exploitation of this vulnerability could cause SLPD to consume significant CPU resources.VMware would like to thank Nicolas Gregoire and US CERT for reporting th...

VMware View Planner update addresses remote code execution vulnerability (CVE-2021-21978)

3. Advisory Details VMware View Planner contains a remote code execution vulnerability. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 8.6...

VMware Horizon Client update addresses a denial-of-service vulnerability (CVE-2020-3991)

3. File system access control denial-of-service vulnerability CVE-2020-3991 VMware Horizon Client for Windows contains a denial-of-service vulnerability due to a file system access control issue during install time. VMware has evaluated the severity of this issue to be in the Moderate severity...

VMware Workstation, Fusion, VMware Remote Console and Horizon Client updates address privilege escalation and denial-of-service vulnerabilities (CVE-2020-3950, CVE-2020-3951)

3a. Privilege escalation vulnerability via setuid binaries CVE-2020-3950 VMware Fusion, VMRC for Mac and Horizon Client for Mac contain a privilege escalation vulnerability due to improper use of setuid binaries. VMware has evaluated the severity of this issue to be in the Important severity rang...

VMSA-2013-0007:VMware ESX patch address security issues

VMSA-2013-0007.1 VMware ESX third party update for Service Console package sudo VMware Security Advisory VMware Security Advisory Advisory ID: VMSA-2013-0007.1 VMware Security Advisory Synopsis: VMware ESX third party update for Service Console package sudo VMware Security Advisory Issue date:...

ESX Service Console and vMA third party updates

a. vMA and Service Console update for newt to 0.52.2-12.el54.1 Newt is a programming library for color text mode, widget based user interfaces. Newt can be used to add stacked windows, entry widgets, checkboxes, radio buttons, labels, plain text fields, scrollbars, etc., to text mode user...

VMSA-2024-0011:VMware ESXi, Workstation, Fusion and vCenter Server updates address multiple security vulnerabilities (CVE-2024-22273, CVE-2024-22274, CVE-2024-22275)

Advisory ID: | VMSA-2024-0011.1 ---|--- Advisory Severity: | Important CVSSv3 Range: | 4.9-8.1 Synopsis: | VMware ESXi, Workstation, Fusion and vCenter Server updates address multiple security vulnerabilities CVE-2024-22273, CVE-2024-22274, CVE-2024-22275 Issue date: | 2024-05-21 Issue date: |...

VMware SD-WAN update addresses a bypass authentication vulnerability (CVE-2023-20899)

3. VMware SD-WAN Bypass Authentication Vulnerability CVE-2023-20899 VMware SD-WAN contains a bypass authentication vulnerability. VMware has evaluated the severity of this issue to be in the moderate severity range with a maximum CVSSv3 base score of 5.3...

VMware ThinApp update addresses a DLL hijacking vulnerability (CVE-2021-22000)

3. VMware ThinApp update addresses a DLL hijacking vulnerability CVE-2021-22000 VMware ThinApp contains a DLL hijacking vulnerability due to insecure loading of DLLs. VMware has evaluated the severity of this issue to be in the Moderate severity range with a maximum CVSSv3 base score of 6.8...

VMware vRealize Operations updates address Server Side Request Forgery and Arbitrary File Write vulnerabilities (CVE-2021-21975, CVE-2021-21983)

1. Impacted Products VMware vRealize Operations VMware Cloud Foundation vRealize Suite Lifecycle Manager 2. Introduction Multiple vulnerabilities in VMware vRealize Operations were privately reported to VMware. Patches and Workarounds are available to address these vulnerabilities in impacted...

VMSA-2020-0004:VMware Horizon Client, VMRC, VMware Workstation and Fusion updates address use-after-free and privilege escalation vulnerabilities

Advisory ID: VMSA-2020-0004.1 CVSSv3 Range: 7.3-9.3 Issue Date:2020-03-12 Updated On: 2020-03-14 CVEs: CVE-2019-5543, CVE-2020-3947 , CVE-2020-3948 Synopsis: VMware Horizon Client, VMRC, VMware Workstation and Fusion updates address use-after-free and privilege escalation vulnerabilities...

VMSA-2016-0009:VMware vCenter Server updates address an HIGH reflected cross-site scripting issue

VMSA-2016-0009 VMware vCenter Server updates address an important reflected cross-site scripting issue VMware Security Advisory VMware Security Advisory Advisory ID: VMSA-2016-0009 VMware Security Advisory Synopsis: VMware vCenter Server updates address an important reflected cross-site scripting...

VMware ESX third party updates for Service Console packages glibc and dhcp

a. Service Console update for DHCPThe DHCP client daemon, dhclient, does not properly sanatize certain options in DHCP server replies. An attacker could send a specially crafted DHCP server reply, that is saved on the client system and evaluated by a process that assumes the option is trusted. Th...

VMSA-2011-0002:Cisco Nexus 1000V VEM updates address denial of service in VMware ESX/ESXi

VMSA-2011-0002 Cisco Nexus 1000V VEM updates address denial of service in VMware ESX/ESXi VMware Security Advisory VMware Security Advisory Advisory ID: VMSA-2011-0002 VMware Security Advisory Synopsis: Cisco Nexus 1000V VEM updates address denial of service in VMware ESX/ESXi VMware Security...

VMware vCenter Update Manager fix for Jetty Web server addresses important security vulnerabilities

a. VMware vCenter Update Manager Jetty Web server vulnerabilities VMware vCenter Update Manager is an automated patch management solution for VMware ESX hosts and Microsoft virtual machines. Update Manager embeds the Jetty Web server which is a third party component. The default version of the...

VMware Tanzu Application Service for VMs and Isolation Segment updates address information disclosure vulnerability (CVE-2023-20891)

3. VMware Tanzu Application Service for VMs and Isolation Segment information disclosure vulnerability CVE-2023-20891 The VMware Tanzu Application Service for VMs and Isolation Segment contain an information disclosure vulnerability due to the logging of credentials in hex encoding in platform...

VMware Aria Operations for Networks updates address multiple vulnerabilities. (CVE-2023-20887, CVE-2023-20888, CVE-2023-20889)

3a. Aria Operations for Networks Command Injection Vulnerability CVE-2023-20887 Aria Operations for Networks contains a command injection vulnerability. VMware has evaluated the severity of this issue to be in the critical severity range with a maximum CVSSv3 base score of 9.8. 3b. Aria Operation...