Vulnerability-Lookup - Search a vulnerability

Refine your search

Product

Sort by

Order

Sources

CERTFR-2025-AVI-0592

Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans les produits VMware. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance et une atteinte à la confidentialité des données.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
VMware	Telco Cloud Infrastructure	Telco Cloud Infrastructure versions 3.x et 2.x sans le correctif ESXi70U3w-24784741
VMware	Cloud Foundation	Cloud Foundation et vSphere Foundation versions 9.0.0.0 sans le correctif ESXi-9.0.0.0100-24813472
VMware	Fusion	Fusion versions 13.x antérieures à 13.6.4
VMware	Telco Cloud Platform	Telco Cloud Platform versions 3.x et 2.x sans le correctif ESXi70U3w-24784741
VMware	Cloud Foundation	Cloud Foundation versions 5.x sans le correctif ESXi80U3f-24784735
VMware	Workstation	Worstation versions 17.x antérieures à 17.6.4
VMware	VMware Tools	VMware Tools versions 13.x.x antérieures à 13.0.1.0 pour Windows
VMware	ESXi	ESXI versions 7.0 sans le correctif ESXi70U3w-24784741
VMware	VMware Tools	VMware Tools versions antérieures à 12.5.3 pour Windows
VMware	Cloud Foundation	Cloud Foundation versions 4.5.x sans le correctif ESXi70U3w-24784741
VMware	ESXi	ESXI versions 8.0 sans les correctifs ESXi80U3f-24784735 et ESXi80U2e-24789317

References

Title

Publication Time

Tags

Bulletin de sécurité VMware 35877

2025-07-15

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Telco Cloud Infrastructure versions 3.x et 2.x sans le correctif ESXi70U3w-24784741",
      "product": {
        "name": "Telco Cloud Infrastructure",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "Cloud Foundation et vSphere Foundation versions 9.0.0.0 sans le correctif ESXi-9.0.0.0100-24813472",
      "product": {
        "name": "Cloud Foundation",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "Fusion versions 13.x ant\u00e9rieures \u00e0 13.6.4",
      "product": {
        "name": "Fusion",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "Telco Cloud Platform versions  3.x et 2.x sans le correctif ESXi70U3w-24784741",
      "product": {
        "name": "Telco Cloud Platform",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "Cloud Foundation versions 5.x sans le correctif ESXi80U3f-24784735",
      "product": {
        "name": "Cloud Foundation",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "Worstation versions 17.x ant\u00e9rieures \u00e0 17.6.4",
      "product": {
        "name": "Workstation",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "VMware Tools versions 13.x.x ant\u00e9rieures \u00e0 13.0.1.0 pour Windows",
      "product": {
        "name": "VMware Tools",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "ESXI versions 7.0 sans le correctif ESXi70U3w-24784741",
      "product": {
        "name": "ESXi",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "VMware Tools versions ant\u00e9rieures \u00e0 12.5.3 pour Windows",
      "product": {
        "name": "VMware Tools",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "Cloud Foundation versions 4.5.x sans le correctif ESXi70U3w-24784741",
      "product": {
        "name": "Cloud Foundation",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "ESXI versions 8.0 sans les correctifs ESXi80U3f-24784735 et  ESXi80U2e-24789317",
      "product": {
        "name": "ESXi",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2025-41236",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-41236"
    },
    {
      "name": "CVE-2025-41237",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-41237"
    },
    {
      "name": "CVE-2025-41238",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-41238"
    },
    {
      "name": "CVE-2025-41239",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-41239"
    }
  ],
  "initial_release_date": "2025-07-16T00:00:00",
  "last_revision_date": "2025-07-16T00:00:00",
  "links": [],
  "reference": "CERTFR-2025-AVI-0592",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-07-16T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits VMware. Elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits VMware",
  "vendor_advisories": [
    {
      "published_at": "2025-07-15",
      "title": "Bulletin de s\u00e9curit\u00e9 VMware 35877",
      "url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/35877"
    }
  ]
}

CERTFR-2025-AVI-0430

Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans les produits VMware. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une injection de code indirecte à distance (XSS).

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
VMware	Telco Cloud Platform	Telco Cloud Platform sans le correctif de sécurité 8.0 U3e pour vCenter
VMware	Telco Cloud Infrastructure	Telco Cloud Infrastructure versions 3.x sans le correctif de sécurité ESXi80U3se-24659227 pour ESXi
VMware	ESXi	ESXi versions 8.0 sans le correctif de sécurité ESXi80U3se-24659227
VMware	Cloud Foundation	Cloud Foundation versions 5.x sans le correctif de sécurité ESXi80U3se-24659227 pour ESXi
VMware	Telco Cloud Platform	Telco Cloud Platform sans le correctif de sécurité ESXi80U3se-24659227 pour ESXi
VMware	Telco Cloud Infrastructure	Telco Cloud Infrastructure versions 3.x sans le correctif de sécurité 8.0 U3e pour vCenter
VMware	Fusion	Fusion versions 13.x antérieures à 13.6.3 sur macOS
VMware	vCenter Server	vCenter Server versions 7.0 sans le correctif de sécurité 7.0 U3v
VMware	Cloud Foundation	Cloud Foundation versions 4.5.x sans le correctif de sécurité 7.0 U3v pour vCenter
VMware	Workstation	Workstation versions 17.x antérieures à 17.6.3
VMware	Telco Cloud Infrastructure	Telco Cloud Infrastructure versions 2.x sans le correctif de sécurité 7.0 U3v pour vCenter
VMware	vCenter Server	vCenter Server versions 8.0 sans le correctif de sécurité 8.0 U3e
VMware	Cloud Foundation	Cloud Foundation versions 5.x sans le correctif de sécurité 8.0 U3e pour vCenter
VMware	Cloud Foundation	Cloud Foundation versions 4.5.x sans le correctif de sécurité ESXi70U3sv-24723868 pour ESXi
VMware	Telco Cloud Infrastructure	Telco Cloud Infrastructure versions 2.x sans le correctif de sécurité ESXi70U3sv-24723868 pour ESXi
VMware	ESXi	ESXi versions 7.0 sans le correctif de sécurité ESXi70U3sv-24723868

References

Title

Publication Time

Tags

Bulletin de sécurité VMware 25717

2025-05-20

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Telco Cloud Platform sans le correctif de s\u00e9curit\u00e9 8.0 U3e pour vCenter",
      "product": {
        "name": "Telco Cloud Platform",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "Telco Cloud Infrastructure versions 3.x sans le correctif de s\u00e9curit\u00e9 ESXi80U3se-24659227 pour ESXi",
      "product": {
        "name": "Telco Cloud Infrastructure",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "ESXi versions 8.0 sans le correctif de s\u00e9curit\u00e9 ESXi80U3se-24659227",
      "product": {
        "name": "ESXi",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "Cloud Foundation versions 5.x sans le correctif de s\u00e9curit\u00e9 ESXi80U3se-24659227 pour ESXi",
      "product": {
        "name": "Cloud Foundation",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "Telco Cloud Platform sans le correctif de s\u00e9curit\u00e9 ESXi80U3se-24659227 pour ESXi",
      "product": {
        "name": "Telco Cloud Platform",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "Telco Cloud Infrastructure versions 3.x sans le correctif de s\u00e9curit\u00e9 8.0 U3e pour vCenter",
      "product": {
        "name": "Telco Cloud Infrastructure",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "Fusion versions 13.x ant\u00e9rieures \u00e0 13.6.3 sur macOS",
      "product": {
        "name": "Fusion",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "vCenter Server versions 7.0 sans le correctif de s\u00e9curit\u00e9 7.0 U3v",
      "product": {
        "name": "vCenter Server",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "Cloud Foundation versions 4.5.x sans le correctif de s\u00e9curit\u00e9 7.0 U3v pour vCenter",
      "product": {
        "name": "Cloud Foundation",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "Workstation versions 17.x ant\u00e9rieures \u00e0 17.6.3",
      "product": {
        "name": "Workstation",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "Telco Cloud Infrastructure versions 2.x sans le correctif de s\u00e9curit\u00e9 7.0 U3v pour vCenter",
      "product": {
        "name": "Telco Cloud Infrastructure",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "vCenter Server versions 8.0 sans le correctif de s\u00e9curit\u00e9 8.0 U3e",
      "product": {
        "name": "vCenter Server",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "Cloud Foundation versions 5.x sans le correctif de s\u00e9curit\u00e9 8.0 U3e pour vCenter",
      "product": {
        "name": "Cloud Foundation",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "Cloud Foundation versions 4.5.x sans le correctif de s\u00e9curit\u00e9 ESXi70U3sv-24723868 pour ESXi",
      "product": {
        "name": "Cloud Foundation",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "Telco Cloud Infrastructure versions 2.x sans le correctif de s\u00e9curit\u00e9 ESXi70U3sv-24723868 pour ESXi",
      "product": {
        "name": "Telco Cloud Infrastructure",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "ESXi versions 7.0 sans le correctif de s\u00e9curit\u00e9 ESXi70U3sv-24723868",
      "product": {
        "name": "ESXi",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2025-41227",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-41227"
    },
    {
      "name": "CVE-2025-41225",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-41225"
    },
    {
      "name": "CVE-2025-41228",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-41228"
    },
    {
      "name": "CVE-2025-41226",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-41226"
    }
  ],
  "initial_release_date": "2025-05-21T00:00:00",
  "last_revision_date": "2025-05-21T00:00:00",
  "links": [],
  "reference": "CERTFR-2025-AVI-0430",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-05-21T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits VMware. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance et une injection de code indirecte \u00e0 distance (XSS).",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits VMware",
  "vendor_advisories": [
    {
      "published_at": "2025-05-20",
      "title": "Bulletin de s\u00e9curit\u00e9 VMware 25717",
      "url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25717"
    }
  ]
}

CERTFR-2025-AVI-0177

Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans les produits VMware. Elles permettent à un attaquant de provoquer une exécution de code arbitraire, une atteinte à la confidentialité des données et un contournement de la politique de sécurité.

VMware indique que les vulnérabilités CVE-2025-222234, CVE-2025-22225 et CVE-2025-22226 sont activement exploitées.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
VMware	Cloud Foundation	VMware Cloud Foundation versions 4.5.x sans le correctif de sécurité ESXi70U3s-24585291
VMware	Telco Cloud Platform	VMware Telco Cloud Platorm sans le correctif de sécurité KB389385
VMware	ESXi	VMware ESXi versions 7.0 sans le correctif de sécurité ESXi70U3s-24585291
VMware	Cloud Foundation	VMware Cloud Foundation versions 5.x sans le correctif de sécurité ESXi80U3d-24585383
VMware	Fusion	VMware Fusion 13.x versions antérieures à 13.6.3
VMware	ESXi	VMware ESXi versions 8.0 sans le correctif de sécurité ESXi80U2d-24585300 ou ESXi80U3d-24585383
VMware	Telco Cloud Infrastructure	VMware Telco Cloud Infrastructure versions 2.x et 3.x sans le correctif de sécurité KB389385
VMware	Workstation	VMware Workstation versions 17.x antérieures à 17.6.3

References

Title

Publication Time

Tags

Bulletin de sécurité VMware 25466	2025-03-04	vendor-advisory
Bulletin de sécurité VMware 25390	2025-03-04	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "VMware Cloud Foundation versions 4.5.x sans le correctif de s\u00e9curit\u00e9 ESXi70U3s-24585291",
      "product": {
        "name": "Cloud Foundation",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "VMware Telco Cloud Platorm sans le correctif de s\u00e9curit\u00e9 KB389385",
      "product": {
        "name": "Telco Cloud Platform",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "VMware ESXi versions 7.0 sans le correctif de s\u00e9curit\u00e9 ESXi70U3s-24585291",
      "product": {
        "name": "ESXi",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "VMware Cloud Foundation versions 5.x sans le correctif de s\u00e9curit\u00e9 ESXi80U3d-24585383",
      "product": {
        "name": "Cloud Foundation",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "VMware Fusion 13.x versions ant\u00e9rieures \u00e0 13.6.3",
      "product": {
        "name": "Fusion",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "VMware ESXi versions 8.0  sans le correctif de s\u00e9curit\u00e9 ESXi80U2d-24585300 ou ESXi80U3d-24585383",
      "product": {
        "name": "ESXi",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "VMware Telco Cloud Infrastructure versions 2.x et 3.x sans le correctif de s\u00e9curit\u00e9  KB389385",
      "product": {
        "name": "Telco Cloud Infrastructure",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "VMware Workstation versions 17.x ant\u00e9rieures \u00e0 17.6.3",
      "product": {
        "name": "Workstation",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2025-22224",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-22224"
    },
    {
      "name": "CVE-2024-38814",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-38814"
    },
    {
      "name": "CVE-2025-22226",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-22226"
    },
    {
      "name": "CVE-2025-22225",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-22225"
    }
  ],
  "initial_release_date": "2025-03-05T00:00:00",
  "last_revision_date": "2025-03-05T00:00:00",
  "links": [],
  "reference": "CERTFR-2025-AVI-0177",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-03-05T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits VMware. Elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et un contournement de la politique de s\u00e9curit\u00e9.\n\nVMware indique que les vuln\u00e9rabilit\u00e9s CVE-2025-222234, CVE-2025-22225 et  CVE-2025-22226 sont activement exploit\u00e9es.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits VMware",
  "vendor_advisories": [
    {
      "published_at": "2025-03-04",
      "title": "Bulletin de s\u00e9curit\u00e9 VMware 25466",
      "url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25466"
    },
    {
      "published_at": "2025-03-04",
      "title": "Bulletin de s\u00e9curit\u00e9 VMware 25390",
      "url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25390"
    }
  ]
}

CERTFR-2024-AVI-0732

Vulnerability from certfr_avis

Une vulnérabilité a été découverte dans VMware Fusion. Elle permet à un attaquant de provoquer une exécution de code arbitraire.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

	Vendor	Product	Description
	VMware	Fusion	Fusion versions 13.x antérieures à 13.6 sur MacOS

References

Title

Publication Time

Tags

Bulletin de sécurité VMware 24939

2024-09-03

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Fusion versions 13.x ant\u00e9rieures \u00e0 13.6 sur MacOS",
      "product": {
        "name": "Fusion",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2024-38811",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-38811"
    }
  ],
  "initial_release_date": "2024-09-03T00:00:00",
  "last_revision_date": "2024-09-03T00:00:00",
  "links": [],
  "reference": "CERTFR-2024-AVI-0732",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-09-03T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans VMware Fusion. Elle permet \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire.",
  "title": "Vuln\u00e9rabilit\u00e9 dans les produits VMware",
  "vendor_advisories": [
    {
      "published_at": "2024-09-03",
      "title": "Bulletin de s\u00e9curit\u00e9 VMware 24939",
      "url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24939"
    }
  ]
}

CERTFR-2024-AVI-0427

Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans les produits VMware. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une atteinte à la confidentialité des données et un déni de service à distance.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
VMware	Fusion	Fusion versions 13.x antérieures à 13.5.1 (la version la plus récente est 13.5.2)
VMware	ESXi	ESXi versions 7.x antérieures à 7.0 Update 3q
VMware	vCenter Server	vCenter Server versions 7.x antérieures à 7.0 Update 3q
VMware	N/A	Workstation versions 17.x antérieures à 17.5.1 (la version la plus récente est 17.5.2)
VMware	N/A	Cloud Foundation (ESXi et vCenter Server) versions 4.x sans le dernier correctif de sécurité
VMware	vCenter Server	vCenter Server versions 8.x antérieures à 8.0 Update 2b
VMware	N/A	Cloud Foundation (ESXi et vCenter Server) versions 5.x antérieures à 5.1.1
VMware	ESXi	ESXi versions 8.x antérieures à 8.0 Update 2b

References

Title

Publication Time

Tags

Bulletin de sécurité VMware 24308

2024-05-21

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Fusion versions 13.x ant\u00e9rieures \u00e0 13.5.1 (la version la plus r\u00e9cente est 13.5.2)",
      "product": {
        "name": "Fusion",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "ESXi versions 7.x ant\u00e9rieures \u00e0 7.0 Update 3q",
      "product": {
        "name": "ESXi",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "vCenter Server versions 7.x ant\u00e9rieures \u00e0 7.0 Update 3q",
      "product": {
        "name": "vCenter Server",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "Workstation versions 17.x ant\u00e9rieures \u00e0 17.5.1 (la version la plus r\u00e9cente est 17.5.2)",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "Cloud Foundation (ESXi et vCenter Server) versions 4.x sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "vCenter Server versions 8.x ant\u00e9rieures \u00e0 8.0 Update 2b",
      "product": {
        "name": "vCenter Server",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "Cloud Foundation (ESXi et vCenter Server) versions 5.x ant\u00e9rieures \u00e0 5.1.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "ESXi versions 8.x ant\u00e9rieures \u00e0 8.0 Update 2b",
      "product": {
        "name": "ESXi",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2024-22275",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-22275"
    },
    {
      "name": "CVE-2024-22273",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-22273"
    },
    {
      "name": "CVE-2024-22274",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-22274"
    }
  ],
  "initial_release_date": "2024-05-22T00:00:00",
  "last_revision_date": "2024-05-22T00:00:00",
  "links": [],
  "reference": "CERTFR-2024-AVI-0427",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-05-22T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits VMware. Elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et un d\u00e9ni de service \u00e0 distance.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits VMware",
  "vendor_advisories": [
    {
      "published_at": "2024-05-21",
      "title": "Bulletin de s\u00e9curit\u00e9 VMware 24308",
      "url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24308"
    }
  ]
}

CERTFR-2024-AVI-0405

Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans les produits VMware. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à la confidentialité des données.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

	Vendor	Product	Description
	VMware	N/A	VMware Workstation Pro et Player versions 17.x antérieures à 17.5.2
	VMware	Fusion	VMware Fusion versions 13.x antérieures à 13.5.2

References

Title

Publication Time

Tags

Bulletin de sécurité VMware 24280 (VMSA-2024-0010) du 14 mai 2024

None

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "VMware Workstation Pro et Player versions 17.x ant\u00e9rieures \u00e0 17.5.2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "VMware Fusion versions 13.x ant\u00e9rieures \u00e0 13.5.2",
      "product": {
        "name": "Fusion",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2024-22267",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-22267"
    },
    {
      "name": "CVE-2024-22269",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-22269"
    },
    {
      "name": "CVE-2024-22268",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-22268"
    },
    {
      "name": "CVE-2024-22270",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-22270"
    }
  ],
  "initial_release_date": "2024-05-15T00:00:00",
  "last_revision_date": "2024-05-15T00:00:00",
  "links": [],
  "reference": "CERTFR-2024-AVI-0405",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-05-15T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nVMware. Elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de\ncode arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance et une\natteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits VMware",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 VMware 24280 (VMSA-2024-0010) du 14 mai 2024",
      "url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24280"
    }
  ]
}

CERTFR-2024-AVI-0186

Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans les produits VMware. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire, une atteinte à la confidentialité des données et une atteinte à l'intégrité des données.

Solution

Se référer aux mesures de contournement proposées par l’éditeur (cf. section Documentation).

Contournement provisoire

Se référer au bulletin de sécurité de l'éditeur pour les mesures de contournement (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
VMware	ESXi	ESXi versions 7.0 sans le correctif de sécurité ESXi70U3p-23307199
VMware	N/A	Workstation versions 17.x antérieures à 17.5.1
VMware	Fusion	Fusion versions 13.x antérieures à 13.5.1 sur MacOS
VMware	N/A	VMware Cloud Foundation (ESXi) versions 5.x et 4.x sans le correctif de sécurité KB88287
VMware	ESXi	ESXi versions 8.0 sans les correctifs de sécurité ESXi80U1d-23299997 et ESXi80U2sb-23305545

References

Title

Publication Time

Tags

Bulletin de sécurité VMware VMSA-2024-0006 du 05 mars 2024	None	vendor-advisory
How to remove USB controllers from a Virtual Machine	-	other

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "ESXi versions 7.0 sans le correctif de s\u00e9curit\u00e9 ESXi70U3p-23307199",
      "product": {
        "name": "ESXi",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "Workstation versions 17.x ant\u00e9rieures \u00e0 17.5.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "Fusion versions 13.x ant\u00e9rieures \u00e0 13.5.1 sur MacOS",
      "product": {
        "name": "Fusion",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "VMware Cloud Foundation (ESXi) versions 5.x et 4.x sans le correctif de s\u00e9curit\u00e9 KB88287",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "ESXi versions 8.0 sans les correctifs de s\u00e9curit\u00e9 ESXi80U1d-23299997 et ESXi80U2sb-23305545",
      "product": {
        "name": "ESXi",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer aux mesures de contournement propos\u00e9es par l\u2019\u00e9diteur (cf.\nsection Documentation).\n\n## Contournement provisoire\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour les mesures de\ncontournement (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2024-22252",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-22252"
    },
    {
      "name": "CVE-2024-22253",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-22253"
    },
    {
      "name": "CVE-2024-22255",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-22255"
    },
    {
      "name": "CVE-2024-22254",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-22254"
    }
  ],
  "initial_release_date": "2024-03-06T00:00:00",
  "last_revision_date": "2024-03-06T00:00:00",
  "links": [
    {
      "title": "How to remove USB controllers from a Virtual Machine",
      "url": "https://kb.vmware.com/s/article/96682"
    }
  ],
  "reference": "CERTFR-2024-AVI-0186",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-03-06T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans \u003cspan\nclass=\"textit\"\u003eles produits VMware\u003c/span\u003e. Certaines d\u0027entre elles\npermettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire,\nune atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et une atteinte \u00e0\nl\u0027int\u00e9grit\u00e9 des donn\u00e9es.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits VMware",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 VMware VMSA-2024-0006 du 05 mars 2024",
      "url": "https://www.vmware.com/security/advisories/VMSA-2024-0006.html"
    }
  ]
}

CERTFR-2024-AVI-0169

Vulnerability from certfr_avis

Une vulnérabilité a été découverte dans les produits VMware. Elle permet à un attaquant de provoquer une atteinte à la confidentialité des données.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

	Vendor	Product	Description
	VMware	N/A	Workstation Pro versions antérieures à 17.5.1
	VMware	Fusion	Fusion versions antérieures à 13.5.1

References

Title

Publication Time

Tags

Bulletin de sécurité VMware VMSA-2024-0005 du 27 février 2024

None

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Workstation Pro versions ant\u00e9rieures \u00e0 17.5.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "Fusion versions ant\u00e9rieures \u00e0 13.5.1",
      "product": {
        "name": "Fusion",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2024-22251",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-22251"
    }
  ],
  "initial_release_date": "2024-02-28T00:00:00",
  "last_revision_date": "2024-02-28T00:00:00",
  "links": [],
  "reference": "CERTFR-2024-AVI-0169",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-02-28T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans \u003cspan class=\"textit\"\u003eles\nproduits VMware\u003c/span\u003e. Elle permet \u00e0 un attaquant de provoquer une\natteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans les produits VMware",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 VMware VMSA-2024-0005 du 27 f\u00e9vrier 2024",
      "url": "https://www.vmware.com/security/advisories/VMSA-2024-0005.html"
    }
  ]
}

CERTFR-2023-AVI-0870

Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans les produits VMware. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une atteinte à la confidentialité des données et une élévation de privilèges.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
VMware	N/A	VMware Aria Operations for Logs versions 8.x antérieures à 8.14
VMware	Cloud Foundation	VMware Cloud Foundation (VMware Aria Operations for Logs) versions 5.x et 4.x (se référer au KB95212 de l'éditeur)
VMware	Fusion	Fusion versions 13.x antérieures à 13.5 sur OS X

References

Title

Publication Time

Tags

Bulletin de sécurité VMware VMSA-2023-0021 du 19 octobre 2023	None	vendor-advisory
Bulletin de sécurité VMware VMSA-2023-0022 du 19 octobre 2023	None	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "VMware Aria Operations for Logs versions 8.x ant\u00e9rieures \u00e0 8.14",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "VMware Cloud Foundation (VMware Aria Operations for Logs) versions 5.x et 4.x (se r\u00e9f\u00e9rer au KB95212 de l\u0027\u00e9diteur)",
      "product": {
        "name": "Cloud Foundation",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "Fusion versions 13.x ant\u00e9rieures \u00e0 13.5 sur OS X",
      "product": {
        "name": "Fusion",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2023-34052",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-34052"
    },
    {
      "name": "CVE-2023-34051",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-34051"
    },
    {
      "name": "CVE-2023-34045",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-34045"
    },
    {
      "name": "CVE-2023-34044",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-34044"
    },
    {
      "name": "CVE-2023-34046",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-34046"
    }
  ],
  "initial_release_date": "2023-10-20T00:00:00",
  "last_revision_date": "2023-10-20T00:00:00",
  "links": [],
  "reference": "CERTFR-2023-AVI-0870",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2023-10-20T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nVMware. Elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de\ncode arbitraire \u00e0 distance, une atteinte \u00e0 la confidentialit\u00e9 des\ndonn\u00e9es et une \u00e9l\u00e9vation de privil\u00e8ges.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits VMware",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 VMware VMSA-2023-0021 du 19 octobre 2023",
      "url": "https://www.vmware.com/security/advisories/VMSA-2023-0021.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 VMware VMSA-2023-0022 du 19 octobre 2023",
      "url": "https://www.vmware.com/security/advisories/VMSA-2023-0022.html"
    }
  ]
}

CERTFR-2023-AVI-0342

Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans VMware. Elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données, une élévation de privilèges et une exécution de code arbitraire.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

	Vendor	Product	Description
	VMware	Fusion	VMware Fusion versions 13.x antérieures à 13.0.2
	VMware	N/A	VMware Workstation versions 17.x antérieures à 17.0.2

References

Title

Publication Time

Tags

Bulletin de sécurité Vmware VMSA-2023-0008 du 25 avril 2023

None

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "VMware Fusion versions 13.x ant\u00e9rieures \u00e0 13.0.2",
      "product": {
        "name": "Fusion",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "VMware Workstation versions 17.x ant\u00e9rieures \u00e0 17.0.2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2023-20869",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-20869"
    },
    {
      "name": "CVE-2023-20870",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-20870"
    },
    {
      "name": "CVE-2023-20872",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-20872"
    },
    {
      "name": "CVE-2023-20871",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-20871"
    }
  ],
  "initial_release_date": "2023-04-26T00:00:00",
  "last_revision_date": "2023-04-26T00:00:00",
  "links": [],
  "reference": "CERTFR-2023-AVI-0342",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2023-04-26T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans \u003cspan\nclass=\"textit\"\u003eVMware\u003c/span\u003e. Elles permettent \u00e0 un attaquant de\nprovoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es, une \u00e9l\u00e9vation\nde privil\u00e8ges et une ex\u00e9cution de code arbitraire.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits VMware",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Vmware VMSA-2023-0008 du 25 avril 2023",
      "url": "https://www.vmware.com/security/advisories/VMSA-2023-0008.html"
    }
  ]
}

CERTFR-2022-AVI-1096

Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans les produits VMware. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance et une atteinte à la confidentialité des données.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
VMware	N/A	Access versions 22.09.0.0 versions antérieures à 22.09.1.0 (pour Linux)
VMware	Cloud Foundation	VMware Cloud Foundation (vIDM) toutes versions sans le correctif KB90384
VMware	N/A	VMware vRealize Network Insight (vRNI) versions 6.3 antérieures à 6.3 HF
VMware	N/A	VMware vRealize Network Insight (vRNI) versions 6.6 antérieures à 6.6 HF
VMware	N/A	VMware vRealize Network Insight (vRNI) versions 6.5.x antérieures à 6.5.x HF
VMware	N/A	Cloud Foundation (ESXi) versions 4.x/3.x sans le correctif KB90336
VMware	N/A	VMware vRealize Network Insight (vRNI) versions 6.7 antérieures à 6.7 HF
VMware	N/A	Access versions 21.08.0.1, 21.08.0.0 sans le correctif KB90399 (pour Linux)
VMware	N/A	VMware vRealize Network Insight (vRNI) versions 6.4 antérieures à 6.4 HF
VMware	N/A	Workstation versions 16.x antérieures à 16.2.5
VMware	Fusion	Fusion versions 12.x antérieures à 12.2.5 (pour OS X)
VMware	ESXi	ESXi versions 8.0 sans le correctif ESXi80a-20842819
VMware	ESXi	ESXi versions 7.0 sans le correctif ESXi70U3si-20841705
VMware	N/A	VMware vRealize Network Insight (vRNI) versions 6.2 antérieures à 6.2 HF
VMware	N/A	vIDM versions 3.3.6 sans le correctif KB90399 (pour Linux)

References

Title

Publication Time

Tags

Bulletin de sécurité VMware VMSA-2022-0031 du 13 décembre 2022	None	vendor-advisory
Bulletin de sécurité VMware VMSA-2022-0032 du 13 décembre 2022	None	vendor-advisory
Bulletin de sécurité VMware VMSA-2022-0033 du 13 décembre 2022	None	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Access versions 22.09.0.0 versions ant\u00e9rieures \u00e0 22.09.1.0 (pour Linux)",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "VMware Cloud Foundation (vIDM) toutes versions sans le correctif KB90384",
      "product": {
        "name": "Cloud Foundation",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "VMware vRealize Network Insight (vRNI) versions 6.3 ant\u00e9rieures \u00e0 6.3 HF",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "VMware vRealize Network Insight (vRNI) versions 6.6 ant\u00e9rieures \u00e0 6.6 HF",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "VMware vRealize Network Insight (vRNI) versions 6.5.x ant\u00e9rieures \u00e0 6.5.x HF",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "Cloud Foundation (ESXi) versions 4.x/3.x sans le correctif KB90336",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "VMware vRealize Network Insight (vRNI) versions 6.7 ant\u00e9rieures \u00e0 6.7 HF",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "Access versions 21.08.0.1, 21.08.0.0 sans le correctif KB90399 (pour Linux)",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "VMware vRealize Network Insight (vRNI) versions 6.4 ant\u00e9rieures \u00e0 6.4 HF",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "Workstation versions 16.x ant\u00e9rieures \u00e0 16.2.5",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "Fusion versions 12.x ant\u00e9rieures \u00e0 12.2.5 (pour OS X)",
      "product": {
        "name": "Fusion",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "ESXi versions 8.0 sans le correctif ESXi80a-20842819",
      "product": {
        "name": "ESXi",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "ESXi versions 7.0 sans le correctif ESXi70U3si-20841705",
      "product": {
        "name": "ESXi",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "VMware vRealize Network Insight (vRNI) versions 6.2 ant\u00e9rieures \u00e0 6.2 HF",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "vIDM versions 3.3.6 sans le correctif KB90399 (pour Linux)",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2022-31703",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-31703"
    },
    {
      "name": "CVE-2022-31705",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-31705"
    },
    {
      "name": "CVE-2022-31701",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-31701"
    },
    {
      "name": "CVE-2022-31700",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-31700"
    },
    {
      "name": "CVE-2022-31702",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-31702"
    }
  ],
  "initial_release_date": "2022-12-14T00:00:00",
  "last_revision_date": "2022-12-14T00:00:00",
  "links": [],
  "reference": "CERTFR-2022-AVI-1096",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2022-12-14T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nVMware. Elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de\ncode arbitraire \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des\ndonn\u00e9es.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits VMware",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 VMware VMSA-2022-0031 du 13 d\u00e9cembre 2022",
      "url": "https://www.vmware.com/security/advisories/VMSA-2022-0031.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 VMware VMSA-2022-0032 du 13 d\u00e9cembre 2022",
      "url": "https://www.vmware.com/security/advisories/VMSA-2022-0032.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 VMware VMSA-2022-0033 du 13 d\u00e9cembre 2022",
      "url": "https://www.vmware.com/security/advisories/VMSA-2022-0033.html"
    }
  ]
}

CERTFR-2022-AVI-148

Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans les produits VMware. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à la confidentialité des données.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
VMware	Fusion	VMware Fusion versions 12.x antérieures à 12.2.1
VMware	ESXi	VMware ESXi versions 6.5 antérieures à ESXi650-202202401-SG ou ESXi650-202110101-SG
VMware	ESXi	VMware ESXi versions 7.0 U2 antérieures à ESXi70U2e-19290878
VMware	N/A	VMware Workstation versions 16.x antérieures à 16.2.1
VMware	ESXi	VMware ESXi versions 6.7 antérieures à ESXi670-202111101-SG
VMware	ESXi	VMware ESXi versions 7.0 U1 antérieures à ESXi70U1e-19324898
VMware	ESXi	VMware ESXi versions 7.0 U3 antérieures à ESXi70U3c-19193900

References

Title

Publication Time

Tags

Bulletin de sécurité VMware 2022-0004 du 15 février 2022

None

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "VMware Fusion versions 12.x ant\u00e9rieures \u00e0 12.2.1",
      "product": {
        "name": "Fusion",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "VMware ESXi versions 6.5 ant\u00e9rieures \u00e0 ESXi650-202202401-SG ou ESXi650-202110101-SG",
      "product": {
        "name": "ESXi",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "VMware ESXi versions 7.0 U2 ant\u00e9rieures \u00e0 ESXi70U2e-19290878",
      "product": {
        "name": "ESXi",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "VMware Workstation versions 16.x ant\u00e9rieures \u00e0 16.2.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "VMware ESXi versions 6.7 ant\u00e9rieures \u00e0 ESXi670-202111101-SG",
      "product": {
        "name": "ESXi",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "VMware ESXi versions 7.0 U1 ant\u00e9rieures \u00e0 ESXi70U1e-19324898",
      "product": {
        "name": "ESXi",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "VMware ESXi versions 7.0 U3 ant\u00e9rieures \u00e0 ESXi70U3c-19193900",
      "product": {
        "name": "ESXi",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2021-22042",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22042"
    },
    {
      "name": "CVE-2021-22041",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22041"
    },
    {
      "name": "CVE-2021-22043",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22043"
    },
    {
      "name": "CVE-2021-22050",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22050"
    },
    {
      "name": "CVE-2021-22040",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22040"
    }
  ],
  "initial_release_date": "2022-02-15T00:00:00",
  "last_revision_date": "2022-02-15T00:00:00",
  "links": [],
  "reference": "CERTFR-2022-AVI-148",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2022-02-15T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nVMware. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer\nune ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0\ndistance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits VMware",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 VMware 2022-0004 du 15 f\u00e9vrier 2022",
      "url": "https://www.vmware.com/security/advisories/VMSA-2022-0004.html"
    }
  ]
}

CERTFR-2020-AVI-831

Vulnerability from certfr_avis

Une vulnérabilité a été découverte dans les produits VMware. Elle permet à un attaquant de provoquer un déni de service.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
VMware	Fusion	VMware Fusion versions 12.x antérieures à 12.0
VMware	Cloud Foundation	VMware Cloud Foundation versions 4.x
VMware	N/A	VMware Workstation versions 16.x antérieures à 16.0
VMware	N/A	VMware Workstation versions 15.x antérieures à 15.5.7
VMware	Fusion	VMware Fusion versions 11.x antérieures à 11.5.7
VMware	ESXi	VMware ESXi versions 7.x sans la mise à jour ESXi70U1c-17325551

References

Title

Publication Time

Tags

Bulletin de sécurité WMware VMSA-2020-0029 du 17 décembre 2020

None

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "VMware Fusion versions 12.x ant\u00e9rieures \u00e0 12.0",
      "product": {
        "name": "Fusion",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "VMware Cloud Foundation versions 4.x",
      "product": {
        "name": "Cloud Foundation",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "VMware Workstation versions 16.x ant\u00e9rieures \u00e0 16.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "VMware Workstation versions 15.x ant\u00e9rieures \u00e0 15.5.7",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "VMware Fusion versions 11.x ant\u00e9rieures \u00e0 11.5.7",
      "product": {
        "name": "Fusion",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "VMware ESXi versions 7.x sans la mise \u00e0 jour ESXi70U1c-17325551",
      "product": {
        "name": "ESXi",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2020-3999",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-3999"
    }
  ],
  "initial_release_date": "2020-12-18T00:00:00",
  "last_revision_date": "2020-12-18T00:00:00",
  "links": [],
  "reference": "CERTFR-2020-AVI-831",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2020-12-18T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans les produits VMware. Elle permet\n\u00e0 un attaquant de provoquer un d\u00e9ni de service.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans les produits VMware",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 WMware VMSA-2020-0029 du 17 d\u00e9cembre 2020",
      "url": "https://www.vmware.com/security/advisories/VMSA-2020-0029.html"
    }
  ]
}

CERTFR-2020-AVI-767

Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans VMware les produits VMware. Elles permettent à un attaquant de provoquer une exécution de code arbitraire et une élévation de privilèges.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
VMware	N/A	VMware Workstation Pro / Player (Workstation) versions 15.x antérieures à 15.5.7
VMware	ESXi	VMware ESXi versions 7.x antérieures à ESXi70U1b-17168206
VMware	Fusion	VMware Fusion Pro / Fusion sur OS X versions 11.5.x antérieures à 11.5.7
VMware	ESXi	VMware ESXi versions 6.7.x antérieures à ESXi670-202011101-SG
VMware	ESXi	VMware ESXi versions 6.5.x antérieures à ESXi650-202011301-SG
VMware	Cloud Foundation	VMware Cloud Foundation versions 4.x
VMware	Cloud Foundation	VMware Cloud Foundation versions 3.x

References

Title

Publication Time

Tags

Bulletin de sécurité VMware VMSA-2020-0026 du 19 novembre 2020

None

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "VMware Workstation Pro / Player (Workstation) versions 15.x ant\u00e9rieures \u00e0 15.5.7",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "VMware ESXi versions 7.x ant\u00e9rieures \u00e0 ESXi70U1b-17168206",
      "product": {
        "name": "ESXi",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "VMware Fusion Pro / Fusion sur OS X versions 11.5.x ant\u00e9rieures \u00e0 11.5.7",
      "product": {
        "name": "Fusion",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "VMware ESXi versions 6.7.x ant\u00e9rieures \u00e0 ESXi670-202011101-SG",
      "product": {
        "name": "ESXi",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "VMware ESXi versions 6.5.x ant\u00e9rieures \u00e0 ESXi650-202011301-SG",
      "product": {
        "name": "ESXi",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "VMware Cloud Foundation versions 4.x",
      "product": {
        "name": "Cloud Foundation",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "VMware Cloud Foundation versions 3.x",
      "product": {
        "name": "Cloud Foundation",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2020-4005",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-4005"
    },
    {
      "name": "CVE-2020-4004",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-4004"
    }
  ],
  "initial_release_date": "2020-11-20T00:00:00",
  "last_revision_date": "2020-11-20T00:00:00",
  "links": [],
  "reference": "CERTFR-2020-AVI-767",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2020-11-20T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans VMware les produits\nVMware. Elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de\ncode arbitraire et une \u00e9l\u00e9vation de privil\u00e8ges.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits VMware",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 VMware VMSA-2020-0026 du 19 novembre 2020",
      "url": "https://www.vmware.com/security/advisories/VMSA-2020-0026.html"
    }
  ]
}

CERTFR-2020-AVI-658

Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans les produits VMware. Elles permettent à un attaquant de provoquer une exécution de code arbitraire, un déni de service, une atteinte à l'intégrité et à la confidentialité des données.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
VMware	N/A	vCenter 6.7.x versions antérieures à 6.7 U3
VMware	ESXi	ESXi 7.0.x versions antérieures à ESXi_7.0.1-0.0.16850804
VMware	N/A	vCenter 6.5.x versions antérieures à 6.5 U3K
VMware	Fusion	Fusion 11.x versions antérieures à 11.5.6
VMware	NSX	NSX-T 3.x versions antérieures à 3.0.2
VMware	Cloud Foundation	VMware Cloud Foundation 3.x versions antérieures à 3.10.1.1
VMware	ESXi	ESXi 6.7.x versions antérieures à ESXi670-202010401-SG
VMware	NSX	NSX-T 2.5.x versions antérieures à 2.5.2.2.0
VMware	Cloud Foundation	VMware Cloud Foundation 4.x versions antérieures à 4.1
VMware	ESXi	ESXi 6.5.x versions antérieures à ESXi650-202010401-SG
VMware	N/A	Workstation 15.x toutes versions

References

Title

Publication Time

Tags

Bulletin de sécurité VMware VMSA-2020-0023 du 20 octobre 2020

None

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "vCenter 6.7.x versions ant\u00e9rieures \u00e0 6.7 U3",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "ESXi 7.0.x versions ant\u00e9rieures \u00e0 ESXi_7.0.1-0.0.16850804",
      "product": {
        "name": "ESXi",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "vCenter 6.5.x versions ant\u00e9rieures \u00e0 6.5 U3K",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "Fusion 11.x versions ant\u00e9rieures \u00e0 11.5.6",
      "product": {
        "name": "Fusion",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "NSX-T 3.x versions ant\u00e9rieures \u00e0 3.0.2",
      "product": {
        "name": "NSX",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "VMware Cloud Foundation 3.x versions ant\u00e9rieures \u00e0 3.10.1.1",
      "product": {
        "name": "Cloud Foundation",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "ESXi 6.7.x versions ant\u00e9rieures \u00e0 ESXi670-202010401-SG",
      "product": {
        "name": "ESXi",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "NSX-T 2.5.x versions ant\u00e9rieures \u00e0 2.5.2.2.0",
      "product": {
        "name": "NSX",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "VMware Cloud Foundation 4.x versions ant\u00e9rieures \u00e0 4.1",
      "product": {
        "name": "Cloud Foundation",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "ESXi 6.5.x versions ant\u00e9rieures \u00e0 ESXi650-202010401-SG",
      "product": {
        "name": "ESXi",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "Workstation 15.x toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2020-3981",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-3981"
    },
    {
      "name": "CVE-2020-3994",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-3994"
    },
    {
      "name": "CVE-2020-3993",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-3993"
    },
    {
      "name": "CVE-2020-3995",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-3995"
    },
    {
      "name": "CVE-2020-3982",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-3982"
    },
    {
      "name": "CVE-2020-3992",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-3992"
    }
  ],
  "initial_release_date": "2020-10-20T00:00:00",
  "last_revision_date": "2020-10-20T00:00:00",
  "links": [],
  "reference": "CERTFR-2020-AVI-658",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2020-10-20T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire"
    },
    {
      "description": "D\u00e9ni de service"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nVMware. Elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de\ncode arbitraire, un d\u00e9ni de service, une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 et \u00e0 la\nconfidentialit\u00e9 des donn\u00e9es.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits VMware",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 VMware VMSA-2020-0023 du 20 octobre 2020",
      "url": "https://www.vmware.com/security/advisories/VMSA-2020-0023.html"
    }
  ]
}

CERTFR-2020-AVI-573

Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans les produits VMware. Elles permettent à un attaquant de provoquer un déni de service, une atteinte à la confidentialité des données et une élévation de privilèges.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
VMware	N/A	VMware Workstation pour Windows version 15.x
VMware	N/A	VMware client Horizon pour Windows versions antérieures à 5.4.4
VMware	Fusion	VMware Fusion 11.x

References

Title

Publication Time

Tags

Bulletin de sécurité VMware VMSA-2020-0020 du 14 septembre 2020

None

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "VMware Workstation pour Windows version 15.x",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "VMware client Horizon pour Windows versions ant\u00e9rieures \u00e0 5.4.4",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "VMware Fusion 11.x",
      "product": {
        "name": "Fusion",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2020-3980",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-3980"
    },
    {
      "name": "CVE-2020-3988",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-3988"
    },
    {
      "name": "CVE-2020-3989",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-3989"
    },
    {
      "name": "CVE-2020-3986",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-3986"
    },
    {
      "name": "CVE-2020-3990",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-3990"
    },
    {
      "name": "CVE-2020-3987",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-3987"
    }
  ],
  "initial_release_date": "2020-09-15T00:00:00",
  "last_revision_date": "2020-09-15T00:00:00",
  "links": [],
  "reference": "CERTFR-2020-AVI-573",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2020-09-15T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nVMware. Elles permettent \u00e0 un attaquant de provoquer un d\u00e9ni de service,\nune atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et une \u00e9l\u00e9vation de\nprivil\u00e8ges.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits VMware",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 VMware VMSA-2020-0020 du 14 septembre 2020",
      "url": "https://www.vmware.com/security/advisories/VMSA-2020-0020.html"
    }
  ]
}

CERTFR-2020-AVI-425

Vulnerability from certfr_avis

Une vulnérabilité a été découverte dans les produits VMware. Elle permet à un attaquant de provoquer une élévation de privilèges.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
VMware	N/A	VMRC pour Mac versions antérieures à 11.2.0 sur OS X
VMware	Fusion	Fusion versions 11.x antérieures à 11.5.5 sur OS X
VMware	N/A	Horizon Client pour Mac versions antérieures à 5.4.3 sur OS X

References

Title

Publication Time

Tags

Bulletin de sécurité VMware VMSA-2020-0017 du 10 juillet 2020

None

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "VMRC pour Mac versions ant\u00e9rieures \u00e0 11.2.0 sur OS X",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "Fusion versions 11.x ant\u00e9rieures \u00e0 11.5.5 sur OS X",
      "product": {
        "name": "Fusion",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "Horizon Client pour Mac versions ant\u00e9rieures \u00e0 5.4.3 sur OS X",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2020-3974",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-3974"
    }
  ],
  "initial_release_date": "2020-07-10T00:00:00",
  "last_revision_date": "2020-07-10T00:00:00",
  "links": [],
  "reference": "CERTFR-2020-AVI-425",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2020-07-10T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans les produits VMware. Elle permet\n\u00e0 un attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans les produits VMware",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 VMware VMSA-2020-0017 du 10 juillet 2020",
      "url": "https://www.vmware.com/security/advisories/VMSA-2020-0017.html"
    }
  ]
}

CERTFR-2020-AVI-389

Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans les produits VMware. Elles permettent à un attaquant de provoquer une exécution de code arbitraire et un déni de service.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
VMware	Cloud Foundation	VMware Cloud Foundation 3.x versions antérieures à 3.10.0.1
VMware	Fusion	Fusion 11.x versions antérieures à 11.5.5
VMware	Cloud Foundation	VMware Cloud Foundation 4.x versions antérieures à 4.0.1
VMware	N/A	Workstation 15.x versions antérieures à 15.5.5
VMware	ESXi	ESXi 7.x versions antérieures à ESXi_7.0.0-1.20.16321839
VMware	ESXi	ESXi 6.7.x versions antérieures à ESXi670-202006401-SG
VMware	ESXi	ESXi 6.5.x versions antérieures à ESXi650-202005401-SG

References

Title

Publication Time

Tags

Bulletin de sécurité VMware VMSA-2020-0015 du 23 juin 2020

None

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "VMware Cloud Foundation 3.x versions ant\u00e9rieures \u00e0 3.10.0.1",
      "product": {
        "name": "Cloud Foundation",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "Fusion 11.x versions ant\u00e9rieures \u00e0 11.5.5",
      "product": {
        "name": "Fusion",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "VMware Cloud Foundation 4.x versions ant\u00e9rieures \u00e0 4.0.1",
      "product": {
        "name": "Cloud Foundation",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "Workstation 15.x versions ant\u00e9rieures \u00e0 15.5.5",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "ESXi 7.x versions ant\u00e9rieures \u00e0 ESXi_7.0.0-1.20.16321839",
      "product": {
        "name": "ESXi",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "ESXi 6.7.x versions ant\u00e9rieures \u00e0 ESXi670-202006401-SG",
      "product": {
        "name": "ESXi",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "ESXi 6.5.x versions ant\u00e9rieures \u00e0 ESXi650-202005401-SG",
      "product": {
        "name": "ESXi",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2020-3970",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-3970"
    },
    {
      "name": "CVE-2020-3966",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-3966"
    },
    {
      "name": "CVE-2020-3965",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-3965"
    },
    {
      "name": "CVE-2020-3963",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-3963"
    },
    {
      "name": "CVE-2020-3962",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-3962"
    },
    {
      "name": "CVE-2020-3968",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-3968"
    },
    {
      "name": "CVE-2020-3964",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-3964"
    },
    {
      "name": "CVE-2020-3971",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-3971"
    },
    {
      "name": "CVE-2020-3967",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-3967"
    },
    {
      "name": "CVE-2020-3969",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-3969"
    }
  ],
  "initial_release_date": "2020-06-24T00:00:00",
  "last_revision_date": "2020-06-24T00:00:00",
  "links": [],
  "reference": "CERTFR-2020-AVI-389",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2020-06-24T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire"
    },
    {
      "description": "D\u00e9ni de service"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nVMware. Elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de\ncode arbitraire et un d\u00e9ni de service.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits VMware",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 VMware VMSA-2020-0015 du 23 juin 2020",
      "url": "https://www.vmware.com/security/advisories/VMSA-2020-0015.html"
    }
  ]
}

CERTFR-2020-AVI-372

Vulnerability from certfr_avis

Une vulnérabilité a été découverte dans les produits VMware. Elle permet à un attaquant de provoquer une atteinte à la confidentialité des données.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
VMware	ESXi	ESXi versions 6.7.x antérieures à ESXi670-202006401-SG
VMware	ESXi	ESXi versions 6.5.x antérieures à ESXi650-202005401-SG
VMware	N/A	Workstation versions antérieures à 15.5.5
VMware	Fusion	Fusion versions antérieures à 11.5.5

References

Title

Publication Time

Tags

Bulletin de sécurité VMware VMSA-2020-0012 du 09 juin 2020

None

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "ESXi versions 6.7.x ant\u00e9rieures \u00e0 ESXi670-202006401-SG",
      "product": {
        "name": "ESXi",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "ESXi versions 6.5.x ant\u00e9rieures \u00e0 ESXi650-202005401-SG",
      "product": {
        "name": "ESXi",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "Workstation versions ant\u00e9rieures \u00e0 15.5.5",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "Fusion versions ant\u00e9rieures \u00e0 11.5.5",
      "product": {
        "name": "Fusion",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2020-3960",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-3960"
    }
  ],
  "initial_release_date": "2020-06-12T00:00:00",
  "last_revision_date": "2020-06-12T00:00:00",
  "links": [],
  "reference": "CERTFR-2020-AVI-372",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2020-06-12T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans les produits VMware. Elle permet\n\u00e0 un attaquant de provoquer une atteinte \u00e0 la confidentialit\u00e9 des\ndonn\u00e9es.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans les produits VMware",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 VMware VMSA-2020-0012 du 09 juin 2020",
      "url": "https://www.vmware.com/security/advisories/VMSA-2020-0012.html"
    }
  ]
}

CERTFR-2020-AVI-327

Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans les produits VMware. Elles permettent à un attaquant de provoquer un déni de service et une élévation de privilèges.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
VMware	ESXi	VMware ESXi versions 6.5.x antérieures à ESXi650-202005401-SG
VMware	Fusion	VMware Fusion versions 11.x antérieures à sur OS X
VMware	Fusion	VMware Fusion versions 11.x antérieures à 11.5.2 sur OS X
VMware	N/A	VMware Workstation versions 15.x antérieures à 15.5.2
VMware	N/A	VMware VMRC pour Mac versions 11.x sur OS X
VMware	ESXi	VMware ESXi versions 6.7.x antérieures à ESXi670-202004101-SG
VMware	N/A	VMware Horizon Client pour Mac versions 5.x et antérieures sur OS X

References

Title

Publication Time

Tags

Bulletin de sécurité VMware VMSA-2020-0011 du 28 mai 2020

None

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "VMware ESXi versions 6.5.x ant\u00e9rieures \u00e0 ESXi650-202005401-SG",
      "product": {
        "name": "ESXi",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "VMware Fusion versions 11.x ant\u00e9rieures \u00e0 sur OS X",
      "product": {
        "name": "Fusion",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "VMware Fusion versions 11.x ant\u00e9rieures \u00e0 11.5.2 sur OS X",
      "product": {
        "name": "Fusion",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "VMware Workstation versions 15.x ant\u00e9rieures \u00e0 15.5.2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "VMware VMRC pour Mac versions 11.x sur OS X",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "VMware ESXi versions 6.7.x ant\u00e9rieures \u00e0 ESXi670-202004101-SG",
      "product": {
        "name": "ESXi",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "VMware Horizon Client pour Mac versions 5.x et ant\u00e9rieures sur OS X",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2020-3959",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-3959"
    },
    {
      "name": "CVE-2020-3957",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-3957"
    },
    {
      "name": "CVE-2020-3958",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-3958"
    }
  ],
  "initial_release_date": "2020-05-29T00:00:00",
  "last_revision_date": "2020-05-29T00:00:00",
  "links": [],
  "reference": "CERTFR-2020-AVI-327",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2020-05-29T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nVMware. Elles permettent \u00e0 un attaquant de provoquer un d\u00e9ni de service\net une \u00e9l\u00e9vation de privil\u00e8ges.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits VMware",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 VMware VMSA-2020-0011 du 28 mai 2020",
      "url": "https://www.vmware.com/security/advisories/VMSA-2020-0011.html"
    }
  ]
}

CERTFR-2020-AVI-156

Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans plusieurs produits VMware. Elles permettent à un attaquant de provoquer un déni de service et une élévation de privilèges.

Le CERT-FR a pris connaissance de l'existence de codes d'exploitation, pour l'environnement MacOS, permettant une élévation de privilèges pour exécuter un code arbitraire avec les droits de l'utilisateur root.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
VMware	Fusion	VMware Fusion Pro / Fusion (Fusion) sur MacOS versions antérieures à 11.5.2
VMware	N/A	VMware Horizon Client for Windows versions antérieures à 5.4.0
VMware	N/A	VMware Horizon Client for Mac versions antérieures à 5.4.0
VMware	N/A	VMware Workstation Pro / Player (Workstation) sur Windows versions antérieures à 15.5.2
VMware	N/A	VMware Remote Console for Mac (VMRC for Mac) versions antérieures à 11.0.1

References

Title

Publication Time

Tags

Bulletin de sécurité VMware VMSA-2020-0005 du 17 mars 2020

None

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "VMware Fusion Pro / Fusion (Fusion) sur MacOS versions ant\u00e9rieures \u00e0 11.5.2",
      "product": {
        "name": "Fusion",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "VMware Horizon Client for Windows versions ant\u00e9rieures \u00e0 5.4.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "VMware Horizon Client for Mac versions ant\u00e9rieures \u00e0 5.4.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "VMware Workstation Pro / Player (Workstation) sur Windows versions ant\u00e9rieures \u00e0 15.5.2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "VMware Remote Console for Mac (VMRC for Mac) versions ant\u00e9rieures \u00e0 11.0.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2020-3951",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-3951"
    },
    {
      "name": "CVE-2020-3950",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-3950"
    }
  ],
  "initial_release_date": "2020-03-18T00:00:00",
  "last_revision_date": "2020-03-18T00:00:00",
  "links": [],
  "reference": "CERTFR-2020-AVI-156",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2020-03-18T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans plusieurs produits\nVMware. Elles permettent \u00e0 un attaquant de provoquer un d\u00e9ni de service\net une \u00e9l\u00e9vation de privil\u00e8ges.\n\nLe CERT-FR a pris connaissance de l\u0027existence de codes d\u0027exploitation,\npour l\u0027environnement MacOS, permettant une \u00e9l\u00e9vation de privil\u00e8ges pour\nex\u00e9cuter un code arbitraire avec les droits de l\u0027utilisateur root.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits VMware",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 VMware VMSA-2020-0005 du 17 mars 2020",
      "url": "https://www.vmware.com/security/advisories/VMSA-2020-0005.html"
    }
  ]
}

CERTFR-2020-AVI-150

Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans les produits VMware. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une élévation de privilèges.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
VMware	N/A	Horizon Client pour Windows versions antérieures à 5.3.0
VMware	N/A	Workstation versions 15.x antérieures à 15.5.2
VMware	Fusion	Fusion versions 11.x antérieures à 11.5.2 sur OS X
VMware	N/A	VMRC pour Windows versions antérieures à 11.0.0

References

Title

Publication Time

Tags

Bulletin de sécurité VMware VMSA-2020-0004 du 12 mars 2020

None

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Horizon Client pour Windows versions ant\u00e9rieures \u00e0 5.3.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "Workstation versions 15.x ant\u00e9rieures \u00e0 15.5.2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "Fusion versions 11.x ant\u00e9rieures \u00e0 11.5.2 sur OS X",
      "product": {
        "name": "Fusion",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "VMRC pour Windows versions ant\u00e9rieures \u00e0 11.0.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2020-3947",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-3947"
    },
    {
      "name": "CVE-2019-5543",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-5543"
    },
    {
      "name": "CVE-2020-3948",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-3948"
    }
  ],
  "initial_release_date": "2020-03-13T00:00:00",
  "last_revision_date": "2020-03-13T00:00:00",
  "links": [],
  "reference": "CERTFR-2020-AVI-150",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2020-03-13T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nVMware. Elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de\ncode arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance et une\n\u00e9l\u00e9vation de privil\u00e8ges.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits VMware",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 VMware VMSA-2020-0004 du 12 mars 2020",
      "url": "https://www.vmware.com/security/advisories/VMSA-2020-0004.html"
    }
  ]
}

CERTFR-2019-AVI-560

Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans les produits VMware. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à la confidentialité des données.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
VMware	ESXi	ESXi versions 6.0.x antérieures à ESXi600-201911401-BG ou ESXi600-201911402-BG
VMware	Fusion	Fusion versions 11.x antérieures à 11.5.1
VMware	ESXi	ESXi versions 6.5.x antérieures à ESXi650-201911401-BG ou ESXi650-201911402-BG
VMware	ESXi	ESXi versions 6.7.x antérieures à ESXi670-201911401-BG ou ESXi670-201911402-BG
VMware	N/A	Workstation versions 15.x antérieures à 15.5.1

References

Title

Publication Time

Tags

Bulletin de sécurité VMware VMSA-2019-0021 du 12 novembre 2019	None	vendor-advisory
Bulletin de sécurité VMware VMSA-2019-0020 du 12 novembre 2019	None	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "ESXi versions 6.0.x ant\u00e9rieures \u00e0 ESXi600-201911401-BG ou ESXi600-201911402-BG",
      "product": {
        "name": "ESXi",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "Fusion versions 11.x ant\u00e9rieures \u00e0 11.5.1",
      "product": {
        "name": "Fusion",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "ESXi versions 6.5.x ant\u00e9rieures \u00e0 ESXi650-201911401-BG ou ESXi650-201911402-BG",
      "product": {
        "name": "ESXi",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "ESXi versions 6.7.x ant\u00e9rieures \u00e0 ESXi670-201911401-BG ou ESXi670-201911402-BG",
      "product": {
        "name": "ESXi",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "Workstation versions 15.x ant\u00e9rieures \u00e0 15.5.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2019-11135",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-11135"
    },
    {
      "name": "CVE-2019-5542",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-5542"
    },
    {
      "name": "CVE-2018-12207",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-12207"
    },
    {
      "name": "CVE-2019-5541",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-5541"
    },
    {
      "name": "CVE-2019-5540",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-5540"
    }
  ],
  "initial_release_date": "2019-11-13T00:00:00",
  "last_revision_date": "2019-11-13T00:00:00",
  "links": [],
  "reference": "CERTFR-2019-AVI-560",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2019-11-13T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nVMware. Elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de\ncode arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance et une\natteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits VMware",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 VMware VMSA-2019-0021 du 12 novembre 2019",
      "url": "https://www.vmware.com/security/advisories/VMSA-2019-0021.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 VMware VMSA-2019-0020 du 12 novembre 2019",
      "url": "https://www.vmware.com/security/advisories/VMSA-2019-0020.html"
    }
  ]
}

CERTFR-2019-AVI-536

Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans les produits VMware. Elles permettent à un attaquant de provoquer un déni de service et une atteinte à la confidentialité des données.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
VMware	ESXi	ESXi versions 6.7x antérieures à ESXi670-201908101-SG
VMware	N/A	Workstation versions 15.x antérieures à 15.5.0
VMware	ESXi	ESXi versions 6.5x antérieures à ESXi650-201910401-SG
VMware	Fusion	Fusion versions 11.x antérieures à 11.5.0
VMware	vCenter Server	vCenter Server Appliance versions 6.7x antérieures à 6.7u3a
VMware	vCenter Server	vCenter Server Appliance versions 6.5x antérieures à 6.5u3d

References

Title

Publication Time

Tags

Bulletin de sécurité VMware VMSA-2019-0019 du 24 octobre 2019	None	vendor-advisory
Bulletin de sécurité VMware VMSA-2019-0018 du 24 octobre 2019	None	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "ESXi versions 6.7x ant\u00e9rieures \u00e0 ESXi670-201908101-SG",
      "product": {
        "name": "ESXi",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "Workstation versions 15.x ant\u00e9rieures \u00e0 15.5.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "ESXi versions 6.5x ant\u00e9rieures \u00e0 ESXi650-201910401-SG",
      "product": {
        "name": "ESXi",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "Fusion versions 11.x ant\u00e9rieures \u00e0 11.5.0",
      "product": {
        "name": "Fusion",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "vCenter Server Appliance versions 6.7x ant\u00e9rieures \u00e0 6.7u3a",
      "product": {
        "name": "vCenter Server",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "vCenter Server Appliance versions 6.5x ant\u00e9rieures \u00e0 6.5u3d",
      "product": {
        "name": "vCenter Server",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2019-5537",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-5537"
    },
    {
      "name": "CVE-2019-5536",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-5536"
    },
    {
      "name": "CVE-2019-5538",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-5538"
    }
  ],
  "initial_release_date": "2019-10-25T00:00:00",
  "last_revision_date": "2019-10-25T00:00:00",
  "links": [],
  "reference": "CERTFR-2019-AVI-536",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2019-10-25T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nVMware. Elles permettent \u00e0 un attaquant de provoquer un d\u00e9ni de service\net une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits VMware",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 VMware VMSA-2019-0019 du 24 octobre 2019",
      "url": "https://www.vmware.com/security/advisories/VMSA-2019-0019.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 VMware VMSA-2019-0018 du 24 octobre 2019",
      "url": "https://www.vmware.com/security/advisories/VMSA-2019-0018.html"
    }
  ]
}

CERTFR-2019-AVI-454

Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans les produits VMware. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance et un déni de service à distance.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
VMware	N/A	VMRC versions 10.x antérieures à 10.0.5 sur Windows et Linux
VMware	N/A	Workstation versions 15.x antérieures à 15.5.0
VMware	N/A	Horizon Client versions antérieures à 5.2.0 sur Windows, Mac et Linux
VMware	Fusion	Fusion versions 11.x antérieures à 11.5.0 sur OS X
VMware	ESXi	ESXi versions 6.0x antérieures à ESXi600-201909101-SG
VMware	ESXi	ESXi versions 6.5x antérieures à ESXi650-201903401-SG
VMware	ESXi	ESXi versions 6.7x antérieures à ESXi670-201904101-SG

References

Title

Publication Time

Tags

Bulletin de sécurité VMware VMSA-2019-0014 du 19 septembre 2019

None

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "VMRC versions 10.x ant\u00e9rieures \u00e0 10.0.5 sur Windows et Linux",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "Workstation versions 15.x ant\u00e9rieures \u00e0 15.5.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "Horizon Client versions ant\u00e9rieures \u00e0 5.2.0 sur Windows, Mac et Linux",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "Fusion versions 11.x ant\u00e9rieures \u00e0 11.5.0 sur OS X",
      "product": {
        "name": "Fusion",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "ESXi versions 6.0x ant\u00e9rieures \u00e0 ESXi600-201909101-SG",
      "product": {
        "name": "ESXi",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "ESXi versions 6.5x ant\u00e9rieures \u00e0 ESXi650-201903401-SG",
      "product": {
        "name": "ESXi",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "ESXi versions 6.7x ant\u00e9rieures \u00e0 ESXi670-201904101-SG",
      "product": {
        "name": "ESXi",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2019-5535",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-5535"
    },
    {
      "name": "CVE-2019-5527",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-5527"
    }
  ],
  "initial_release_date": "2019-09-20T00:00:00",
  "last_revision_date": "2019-09-20T00:00:00",
  "links": [],
  "reference": "CERTFR-2019-AVI-454",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2019-09-20T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nVMware. Elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de\ncode arbitraire \u00e0 distance et un d\u00e9ni de service \u00e0 distance.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits VMware",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 VMware VMSA-2019-0014 du 19 septembre 2019",
      "url": "https://www.vmware.com/security/advisories/VMSA-2019-0014.html"
    }
  ]
}

CVE-2025-22226 (GCVE-0-2025-22226)

Vulnerability from nvd

Published

2025-03-04 11:56

Modified

2025-10-21 22:55

Severity ?

7.1 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

CWE

Information disclosure vulnerability

Summary

VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS. A malicious actor with administrative privileges to a virtual machine may be able to exploit this issue to leak memory from the vmx process.

References

URL

Tags

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25390

Impacted products

Vendor

Product

Version

n/a

ESXi

Version: 8.0   < ESXi80U3d-24585383
Version: 8.0   < ESXi80U2d-24585300
Version: 7.0   < ESXi70U3s-24585291

n/a	VMware Workstation	Version: 17.x < 17.6.3
n/a	VMware Fusion	Version: 13.x < 13.6.3
n/a	VMware Cloud Foundation	Version: 5.x, 4.5.x
n/a	VMware Telco Cloud Platform	Version: 5.x, 4.x, 3.x, 2.x
n/a	VMware Telco Cloud Infrastructure	Version: 3.x, 2.x

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-22226",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-05T04:55:25.321408Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2025-03-04",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-22226"
              },
              "type": "kev"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-125",
                "description": "CWE-125 Out-of-bounds Read",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-21T22:55:26.649Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-22226"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2025-03-04T00:00:00+00:00",
            "value": "CVE-2025-22226 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "ESXi",
          "vendor": "n/a",
          "versions": [
            {
              "lessThan": "ESXi80U3d-24585383",
              "status": "affected",
              "version": "8.0",
              "versionType": "custom"
            },
            {
              "lessThan": "ESXi80U2d-24585300",
              "status": "affected",
              "version": "8.0",
              "versionType": "custom"
            },
            {
              "lessThan": "ESXi70U3s-24585291",
              "status": "affected",
              "version": "7.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows",
            "Linux"
          ],
          "product": "VMware Workstation",
          "vendor": "n/a",
          "versions": [
            {
              "lessThan": "17.6.3",
              "status": "affected",
              "version": "17.x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "MacOS"
          ],
          "product": "VMware Fusion",
          "vendor": "n/a",
          "versions": [
            {
              "lessThan": "13.6.3",
              "status": "affected",
              "version": "13.x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "VMware Cloud Foundation",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "5.x, 4.5.x"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "VMware Telco Cloud Platform",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "5.x, 4.x, 3.x, 2.x"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "VMware Telco Cloud Infrastructure",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "3.x, 2.x"
            }
          ]
        }
      ],
      "datePublic": "2025-03-04T11:50:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eVMware ESXi, Workstation, and Fusion contain\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;an information disclosure \u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003evulnerability \u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003edue to an out-of-bounds read in HGFS.\u0026nbsp;\u003c/span\u003eA malicious actor with administrative privileges to a virtual machine may be able to exploit this issue to leak memory from the vmx process.\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u003cbr\u003e\u003cbr\u003e\u003c/span\u003e\u003cbr\u003e"
            }
          ],
          "value": "VMware ESXi, Workstation, and Fusion contain\u00a0an information disclosure vulnerability due to an out-of-bounds read in HGFS.\u00a0A malicious actor with administrative privileges to a virtual machine may be able to exploit this issue to leak memory from the vmx process."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Information disclosure vulnerability",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-03-04T11:56:57.541Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25390"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2025-22226",
    "datePublished": "2025-03-04T11:56:57.541Z",
    "dateReserved": "2025-01-02T04:29:59.190Z",
    "dateUpdated": "2025-10-21T22:55:26.649Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-4004 (GCVE-0-2020-4004)

Vulnerability from nvd

Published

2020-11-20 19:06

Modified

2024-08-04 07:52

Severity ?

CWE

Use-after-free vulnerability

Summary

VMware ESXi (7.0 before ESXi70U1b-17168206, 6.7 before ESXi670-202011101-SG, 6.5 before ESXi650-202011301-SG), Workstation (15.x before 15.5.7), Fusion (11.x before 11.5.7) contain a use-after-free vulnerability in the XHCI USB controller. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host.

References

URL

Tags

https://www.vmware.com/security/advisories/VMSA-2020-0026.html

x_refsource_CONFIRM

Impacted products

Vendor

Product

Version

n/a

VMware ESXi

Version: 7.0 before ESXi70U1b-17168206
Version: 6.7 before ESXi670-202011101-SG
Version: 6.5 before ESXi650-202011301-SG

	n/a	Workstation	Version: 15.x before 15.5.7
	n/a	Fusion	Version: 11.x before 11.5.7

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T07:52:20.492Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.vmware.com/security/advisories/VMSA-2020-0026.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "VMware ESXi",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "7.0 before ESXi70U1b-17168206"
            },
            {
              "status": "affected",
              "version": "6.7 before ESXi670-202011101-SG"
            },
            {
              "status": "affected",
              "version": "6.5 before ESXi650-202011301-SG"
            }
          ]
        },
        {
          "product": "Workstation",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "15.x before 15.5.7"
            }
          ]
        },
        {
          "product": "Fusion",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "11.x before 11.5.7"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "VMware ESXi (7.0 before ESXi70U1b-17168206, 6.7 before ESXi670-202011101-SG, 6.5 before ESXi650-202011301-SG), Workstation (15.x before 15.5.7), Fusion (11.x before 11.5.7) contain a use-after-free vulnerability in the XHCI USB controller. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine\u0027s VMX process running on the host."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Use-after-free vulnerability",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-11-20T19:06:28",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.vmware.com/security/advisories/VMSA-2020-0026.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@vmware.com",
          "ID": "CVE-2020-4004",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "VMware ESXi",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "7.0 before ESXi70U1b-17168206"
                          },
                          {
                            "version_value": "6.7 before ESXi670-202011101-SG"
                          },
                          {
                            "version_value": "6.5 before ESXi650-202011301-SG"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Workstation",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "15.x before 15.5.7"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Fusion",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "11.x before 11.5.7"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "VMware ESXi (7.0 before ESXi70U1b-17168206, 6.7 before ESXi670-202011101-SG, 6.5 before ESXi650-202011301-SG), Workstation (15.x before 15.5.7), Fusion (11.x before 11.5.7) contain a use-after-free vulnerability in the XHCI USB controller. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine\u0027s VMX process running on the host."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Use-after-free vulnerability"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.vmware.com/security/advisories/VMSA-2020-0026.html",
              "refsource": "CONFIRM",
              "url": "https://www.vmware.com/security/advisories/VMSA-2020-0026.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2020-4004",
    "datePublished": "2020-11-20T19:06:28",
    "dateReserved": "2019-12-30T00:00:00",
    "dateUpdated": "2024-08-04T07:52:20.492Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-3950 (GCVE-0-2020-3950)

Vulnerability from nvd

Published

2020-03-17 18:41

Modified

2025-10-21 23:35

Severity ?

7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

Privilege escalation vulnerability

Summary

VMware Fusion (11.x before 11.5.2), VMware Remote Console for Mac (11.x and prior before 11.0.1) and Horizon Client for Mac (5.x and prior before 5.4.0) contain a privilege escalation vulnerability due to improper use of setuid binaries. Successful exploitation of this issue may allow attackers with normal user privileges to escalate their privileges to root on the system where Fusion, VMRC or Horizon Client is installed.

References

URL

Tags

	https://www.vmware.com/security/advisories/VMSA-2020-0005.html	x_refsource_MISC
	http://packetstormsecurity.com/files/156843/VMware-Fusion-11.5.2-Privilege-Escalation.html	x_refsource_MISC
	http://packetstormsecurity.com/files/157079/VMware-Fusion-USB-Arbitrator-Setuid-Privilege-Escalation.html	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	n/a	VMware Fusion, VMware Remote Console for Mac and Horizon Client for Mac	Version: VMware Fusion (11.x before 11.5.2), VMware Remote Console for Mac (11.x and prior before 11.0.1) and Horizon Client for Mac (5.x and prior before 5.4.0)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T07:52:20.546Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.vmware.com/security/advisories/VMSA-2020-0005.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/156843/VMware-Fusion-11.5.2-Privilege-Escalation.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/157079/VMware-Fusion-USB-Arbitrator-Setuid-Privilege-Escalation.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2020-3950",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-29T18:00:39.737303Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2021-11-03",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-3950"
              },
              "type": "kev"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-269",
                "description": "CWE-269 Improper Privilege Management",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-21T23:35:48.178Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-3950"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2021-11-03T00:00:00+00:00",
            "value": "CVE-2020-3950 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "VMware Fusion, VMware Remote Console for Mac and Horizon Client for Mac",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "VMware Fusion (11.x before 11.5.2), VMware Remote Console for Mac (11.x and prior before 11.0.1) and Horizon Client for Mac (5.x and prior before 5.4.0)"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "VMware Fusion (11.x before 11.5.2), VMware Remote Console for Mac (11.x and prior before 11.0.1) and Horizon Client for Mac (5.x and prior before 5.4.0) contain a privilege escalation vulnerability due to improper use of setuid binaries. Successful exploitation of this issue may allow attackers with normal user privileges to escalate their privileges to root on the system where Fusion, VMRC or Horizon Client is installed."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Privilege escalation vulnerability",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-04-03T04:06:04.000Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.vmware.com/security/advisories/VMSA-2020-0005.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.com/files/156843/VMware-Fusion-11.5.2-Privilege-Escalation.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.com/files/157079/VMware-Fusion-USB-Arbitrator-Setuid-Privilege-Escalation.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@vmware.com",
          "ID": "CVE-2020-3950",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "VMware Fusion, VMware Remote Console for Mac and Horizon Client for Mac",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "VMware Fusion (11.x before 11.5.2), VMware Remote Console for Mac (11.x and prior before 11.0.1) and Horizon Client for Mac (5.x and prior before 5.4.0)"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "VMware Fusion (11.x before 11.5.2), VMware Remote Console for Mac (11.x and prior before 11.0.1) and Horizon Client for Mac (5.x and prior before 5.4.0) contain a privilege escalation vulnerability due to improper use of setuid binaries. Successful exploitation of this issue may allow attackers with normal user privileges to escalate their privileges to root on the system where Fusion, VMRC or Horizon Client is installed."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Privilege escalation vulnerability"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.vmware.com/security/advisories/VMSA-2020-0005.html",
              "refsource": "MISC",
              "url": "https://www.vmware.com/security/advisories/VMSA-2020-0005.html"
            },
            {
              "name": "http://packetstormsecurity.com/files/156843/VMware-Fusion-11.5.2-Privilege-Escalation.html",
              "refsource": "MISC",
              "url": "http://packetstormsecurity.com/files/156843/VMware-Fusion-11.5.2-Privilege-Escalation.html"
            },
            {
              "name": "http://packetstormsecurity.com/files/157079/VMware-Fusion-USB-Arbitrator-Setuid-Privilege-Escalation.html",
              "refsource": "MISC",
              "url": "http://packetstormsecurity.com/files/157079/VMware-Fusion-USB-Arbitrator-Setuid-Privilege-Escalation.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2020-3950",
    "datePublished": "2020-03-17T18:41:52.000Z",
    "dateReserved": "2019-12-30T00:00:00.000Z",
    "dateUpdated": "2025-10-21T23:35:48.178Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-22226 (GCVE-0-2025-22226)

Vulnerability from cvelistv5

Published

2025-03-04 11:56

Modified

2025-10-21 22:55

Severity ?

7.1 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

CWE

Information disclosure vulnerability

Summary

VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS. A malicious actor with administrative privileges to a virtual machine may be able to exploit this issue to leak memory from the vmx process.

References

URL

Tags

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25390

Impacted products

Vendor

Product

Version

n/a

ESXi

Version: 8.0   < ESXi80U3d-24585383
Version: 8.0   < ESXi80U2d-24585300
Version: 7.0   < ESXi70U3s-24585291

n/a	VMware Workstation	Version: 17.x < 17.6.3
n/a	VMware Fusion	Version: 13.x < 13.6.3
n/a	VMware Cloud Foundation	Version: 5.x, 4.5.x
n/a	VMware Telco Cloud Platform	Version: 5.x, 4.x, 3.x, 2.x
n/a	VMware Telco Cloud Infrastructure	Version: 3.x, 2.x

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-22226",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-05T04:55:25.321408Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2025-03-04",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-22226"
              },
              "type": "kev"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-125",
                "description": "CWE-125 Out-of-bounds Read",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-21T22:55:26.649Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-22226"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2025-03-04T00:00:00+00:00",
            "value": "CVE-2025-22226 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "ESXi",
          "vendor": "n/a",
          "versions": [
            {
              "lessThan": "ESXi80U3d-24585383",
              "status": "affected",
              "version": "8.0",
              "versionType": "custom"
            },
            {
              "lessThan": "ESXi80U2d-24585300",
              "status": "affected",
              "version": "8.0",
              "versionType": "custom"
            },
            {
              "lessThan": "ESXi70U3s-24585291",
              "status": "affected",
              "version": "7.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows",
            "Linux"
          ],
          "product": "VMware Workstation",
          "vendor": "n/a",
          "versions": [
            {
              "lessThan": "17.6.3",
              "status": "affected",
              "version": "17.x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "MacOS"
          ],
          "product": "VMware Fusion",
          "vendor": "n/a",
          "versions": [
            {
              "lessThan": "13.6.3",
              "status": "affected",
              "version": "13.x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "VMware Cloud Foundation",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "5.x, 4.5.x"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "VMware Telco Cloud Platform",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "5.x, 4.x, 3.x, 2.x"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "VMware Telco Cloud Infrastructure",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "3.x, 2.x"
            }
          ]
        }
      ],
      "datePublic": "2025-03-04T11:50:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eVMware ESXi, Workstation, and Fusion contain\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;an information disclosure \u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003evulnerability \u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003edue to an out-of-bounds read in HGFS.\u0026nbsp;\u003c/span\u003eA malicious actor with administrative privileges to a virtual machine may be able to exploit this issue to leak memory from the vmx process.\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u003cbr\u003e\u003cbr\u003e\u003c/span\u003e\u003cbr\u003e"
            }
          ],
          "value": "VMware ESXi, Workstation, and Fusion contain\u00a0an information disclosure vulnerability due to an out-of-bounds read in HGFS.\u00a0A malicious actor with administrative privileges to a virtual machine may be able to exploit this issue to leak memory from the vmx process."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Information disclosure vulnerability",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-03-04T11:56:57.541Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25390"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2025-22226",
    "datePublished": "2025-03-04T11:56:57.541Z",
    "dateReserved": "2025-01-02T04:29:59.190Z",
    "dateUpdated": "2025-10-21T22:55:26.649Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-3950 (GCVE-0-2020-3950)

Vulnerability from cvelistv5

Published

2020-03-17 18:41

Modified

2025-10-21 23:35

Severity ?

7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

Privilege escalation vulnerability

Summary

VMware Fusion (11.x before 11.5.2), VMware Remote Console for Mac (11.x and prior before 11.0.1) and Horizon Client for Mac (5.x and prior before 5.4.0) contain a privilege escalation vulnerability due to improper use of setuid binaries. Successful exploitation of this issue may allow attackers with normal user privileges to escalate their privileges to root on the system where Fusion, VMRC or Horizon Client is installed.

References

URL

Tags

	https://www.vmware.com/security/advisories/VMSA-2020-0005.html	x_refsource_MISC
	http://packetstormsecurity.com/files/156843/VMware-Fusion-11.5.2-Privilege-Escalation.html	x_refsource_MISC
	http://packetstormsecurity.com/files/157079/VMware-Fusion-USB-Arbitrator-Setuid-Privilege-Escalation.html	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	n/a	VMware Fusion, VMware Remote Console for Mac and Horizon Client for Mac	Version: VMware Fusion (11.x before 11.5.2), VMware Remote Console for Mac (11.x and prior before 11.0.1) and Horizon Client for Mac (5.x and prior before 5.4.0)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T07:52:20.546Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.vmware.com/security/advisories/VMSA-2020-0005.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/156843/VMware-Fusion-11.5.2-Privilege-Escalation.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/157079/VMware-Fusion-USB-Arbitrator-Setuid-Privilege-Escalation.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2020-3950",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-29T18:00:39.737303Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2021-11-03",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-3950"
              },
              "type": "kev"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-269",
                "description": "CWE-269 Improper Privilege Management",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-21T23:35:48.178Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-3950"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2021-11-03T00:00:00+00:00",
            "value": "CVE-2020-3950 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "VMware Fusion, VMware Remote Console for Mac and Horizon Client for Mac",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "VMware Fusion (11.x before 11.5.2), VMware Remote Console for Mac (11.x and prior before 11.0.1) and Horizon Client for Mac (5.x and prior before 5.4.0)"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "VMware Fusion (11.x before 11.5.2), VMware Remote Console for Mac (11.x and prior before 11.0.1) and Horizon Client for Mac (5.x and prior before 5.4.0) contain a privilege escalation vulnerability due to improper use of setuid binaries. Successful exploitation of this issue may allow attackers with normal user privileges to escalate their privileges to root on the system where Fusion, VMRC or Horizon Client is installed."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Privilege escalation vulnerability",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-04-03T04:06:04.000Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.vmware.com/security/advisories/VMSA-2020-0005.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.com/files/156843/VMware-Fusion-11.5.2-Privilege-Escalation.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.com/files/157079/VMware-Fusion-USB-Arbitrator-Setuid-Privilege-Escalation.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@vmware.com",
          "ID": "CVE-2020-3950",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "VMware Fusion, VMware Remote Console for Mac and Horizon Client for Mac",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "VMware Fusion (11.x before 11.5.2), VMware Remote Console for Mac (11.x and prior before 11.0.1) and Horizon Client for Mac (5.x and prior before 5.4.0)"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "VMware Fusion (11.x before 11.5.2), VMware Remote Console for Mac (11.x and prior before 11.0.1) and Horizon Client for Mac (5.x and prior before 5.4.0) contain a privilege escalation vulnerability due to improper use of setuid binaries. Successful exploitation of this issue may allow attackers with normal user privileges to escalate their privileges to root on the system where Fusion, VMRC or Horizon Client is installed."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Privilege escalation vulnerability"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.vmware.com/security/advisories/VMSA-2020-0005.html",
              "refsource": "MISC",
              "url": "https://www.vmware.com/security/advisories/VMSA-2020-0005.html"
            },
            {
              "name": "http://packetstormsecurity.com/files/156843/VMware-Fusion-11.5.2-Privilege-Escalation.html",
              "refsource": "MISC",
              "url": "http://packetstormsecurity.com/files/156843/VMware-Fusion-11.5.2-Privilege-Escalation.html"
            },
            {
              "name": "http://packetstormsecurity.com/files/157079/VMware-Fusion-USB-Arbitrator-Setuid-Privilege-Escalation.html",
              "refsource": "MISC",
              "url": "http://packetstormsecurity.com/files/157079/VMware-Fusion-USB-Arbitrator-Setuid-Privilege-Escalation.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2020-3950",
    "datePublished": "2020-03-17T18:41:52.000Z",
    "dateReserved": "2019-12-30T00:00:00.000Z",
    "dateUpdated": "2025-10-21T23:35:48.178Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Refine your search

69 vulnerabilities found for Fusion by VMware

Vulnerability from certfr_avis

Solutions

Vulnerability from certfr_avis

Solutions

Vulnerability from certfr_avis

Solutions

Vulnerability from certfr_avis

Solutions

Vulnerability from certfr_avis

Solutions

Vulnerability from certfr_avis

Solution

Vulnerability from certfr_avis

Solution

Contournement provisoire

Vulnerability from certfr_avis

Solution

Vulnerability from certfr_avis

Solution

Vulnerability from certfr_avis

Solution

Vulnerability from certfr_avis

Solution

Vulnerability from certfr_avis

Solution

Vulnerability from certfr_avis

Solution

Vulnerability from certfr_avis

Solution

Vulnerability from certfr_avis

Solution

Vulnerability from certfr_avis

Solution

Vulnerability from certfr_avis

Solution

Vulnerability from certfr_avis

Solution

Vulnerability from certfr_avis

Solution

Vulnerability from certfr_avis

Solution

Vulnerability from certfr_avis

Solution

Vulnerability from certfr_avis

Solution

Vulnerability from certfr_avis

Solution

Vulnerability from certfr_avis

Solution

Vulnerability from certfr_avis

Solution

CVE-2025-22226 (GCVE-0-2025-22226)

Vulnerability from nvd

CVE-2020-4004 (GCVE-0-2020-4004)

Vulnerability from nvd

CVE-2020-3950 (GCVE-0-2020-3950)

Vulnerability from nvd

CVE-2025-22226 (GCVE-0-2025-22226)

Vulnerability from cvelistv5

CVE-2020-3950 (GCVE-0-2020-3950)

Vulnerability from cvelistv5