Fusion Security Vulnerabilities - 2023

CVE-2023-20869

VMware Workstation (17.x) and VMware Fusion (13.x) contain a stack-based buffer-overflow vulnerability that exists in the functionality for sharing host Bluetooth devices with the virtual machine.

CVE-2023-20870

VMware Workstation and Fusion contain an out-of-bounds read vulnerability that exists in the functionality for sharing host Bluetooth devices with the virtual machine.

CVE-2023-20871

VMware Fusion contains a local privilege escalation vulnerability. A malicious actor with read/write access to the host operating system can elevate privileges to gain root access to the host operating system.

CVE-2023-20872

VMware Workstation and Fusion contain an out-of-bounds read/write vulnerability in SCSI CD/DVD device emulation.

CVE-2023-34044

VMware Workstation( 17.x prior to 17.5) and Fusion(13.x prior to 13.5) contain an out-of-boundsread vulnerability that exists in the functionality for sharing hostBluetooth devices with the virtual machine. A malicious actor with local administrative privileges on a virtualmachine may be able to re...

CVE-2023-34045

VMware Fusion(13.x prior to 13.5) contains a local privilege escalation vulnerability that occurs duringinstallation for the first time (the user needs to drag or copy theapplication to a folder from the '.dmg' volume) or when installing anupgrade. A malicious actor with local non-administrative us...

CVE-2023-34046

VMware Fusion(13.x prior to 13.5) contains a TOCTOU (Time-of-check Time-of-use)vulnerability that occurs during installation for the first time (theuser needs to drag or copy the application to a folder from the '.dmg'volume) or when installing an upgrade. A malicious actor with local non-administr...