CVE-2020-3963

Published: 25/06/2020 Updated: 27/01/2023

CVSS v2 Base Score: 2.1 | Impact Score: 2.9 | Exploitability Score: 3.9

CVSS v3 Base Score: 5.5 | Impact Score: 3.6 | Exploitability Score: 1.8

VMScore: 187

Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N

VMware ESXi (7.0 before ESXi_7.0.0-1.20.16321839, 6.7 before ESXi670-202006401-SG and 6.5 before ESXi650-202005401-SG), Workstation (15.x prior to 15.5.2), and Fusion (11.x prior to 11.5.2) contain a use-after-free vulnerability in PVNVRAM. A malicious actor with local access to a virtual machine may be able to read privileged information contained in physical memory.

Vulnerable Product	Search on Vulmon	Subscribe to Product
vmware esxi 6.5
vmware esxi 6.7
vmware workstation
vmware fusion
vmware esxi 7.0.0
vmware cloud foundation

Overview ======= We identified several security issues in the ESIx virtual machine monitor (VMM): a use-after-free (UAF) vulnerability in PVNVRAM, a missing return value check in EHCI USB controller leading to private heap information disclosure, and several OOB reads All issues have been fixed by the vendor Links to the patches are provided bel ...

CWE-416 https://www.vmware.com/security/advisories/VMSA-2020-0015.html http://seclists.org/fulldisclosure/2020/Jul/22 http://packetstormsecurity.com/files/158459/VMware-ESXi-Use-After-Free-Out-Of-Bounds-Access.html https://nvd.nist.gov http://seclists.org/fulldisclosure/2020/Jul/22 https://www.vmware.com/security/advisories/VMSA-2020-0015.html

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Product List Vendor List Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2020-3963

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Mailing Lists

References

Vulmon Search

About

Products

Connect