VMware Patches For Workstation And Fusion Available

VMware has released updated versions of their virtualization software patching security vulnerabilities (CVE-2023-20869, CVE-2023-20870, CVE-2023-20871, CVE-2023-20872).

Affected versions:

-VMware Workstation 17.x earlier than 17.0.2

-VMware Fusion 13.x earlier than 13.0.2

More information in the VMware advisory.

VMware Tools Update Available

VMware have released updated versions of their virtualization software to fix a security vulnerability. VMware Tools is affected by a local privilege escalation vulnerability (CVE-2022-31676). A malicious actor with local non-administrative access to the Guest OS can escalate privileges as a root user in the virtual machine.

Affected versions:

-VMware Tools for Windows and Linux versions earlier than 12.1.0

More information with instructions for updating can be read from the correspondent VMware advisory.

VMware Tools Update Available

VMware have released updated versions of their virtualization software to fix a security vulnerability. VMware Tools for Windows is affected by An uncontrolled search path vulnerability (CVE-2022-22943). A malicious actor with local administrative privileges in the Windows guest OS, where VMware Tools is installed, may be able to execute code with system privileges in the Windows guest OS due to an uncontrolled search path element.

Affected versions:

-VMware Tools for Windows versions earlier than 12.0.0

More information with instructions for updating can be read from the correspondent VMware advisory.

Vulnerability in VMware Cloud Foundation

VMware have released updated versions of their virtualization software patching a security vulnerability (CVE-2022-22939).

Affected versions:
-VMware Cloud Foundation (NSX-T) 4.x earlier than 4.3.1.1
-VMware Cloud Foundation (NSX-T) 3.x (patch pending, check back the advisory)

More information in VMware advisory here.

VMware Patches Available

VMware has released updated versions of their virtualization software patching a security vulnerability (CVE-2022-22938).

Affected versions:

-VMware Workstation Pro/Player 16.x for Windows earlier than 16.2.2

-VMware Horizon Client for Windows earlier than 5.5.3

More information in the VMware advisory.

VMware Product Patches Available

VMware has released updated versions of their virtualization software patching a security vulnerability (CVE-2021-22045).

Affected versions:

-VMware ESXi 7.0 (patch pending at the moment of writing this)

-VMware ESXi 6.7 without ESXi670-202111101-SG update

-VMware ESXi 6.5 without ESXi650-202110101-SG update

-VMware Cloud Foundation (ESXi) 4.x (patch pending at the moment of writing this)

-VMware Cloud Foundation (ESXi) 3.x (patch pending at the moment of writing this)

-VMware Workstation 16.x for Windows earlier than 16.2.0

-VMware Fusion Pro / Fusion 12.x earlier than 12.2.0

Workaround for those at "patch pending" stage can be read here.

More information in the VMware advisory.

VMware ThinApp Updated

VMware has released updated version of their ThinApp for Windows. The update fixes a DLL hijacking vulnerability (CVE-2021-22000).

Affected versions:
-VMware ThinApp 5.x earlier than 5.2.10

More information in related VMware advisory.

VMware ESXi Vulnerabilities Fixed

VMware has released updated versions of their virtualization software patching security vulnerabilities (CVE-2021-21994, CVE-2021-21995).

Affected versions:
-VMware ESXi 7.0 without ESXi70U2-17630552
-VMware ESXi 6.7 without ESXi670-202103101-SG update
-VMware ESXi 6.5 without ESXi650-202107401-SG update
-VMware Cloud Foundation (ESXi) 4.x, patch pending
-VMware Cloud Foundation (ESXi) 3.x earlier than 3.10.2

More information in related VMware advisory.

VMware Patches Available

VMware has released updated versions of their virtualization software patching security vulnerabilities (CVE-2020-4004, CVE-2020-4005).

Affected versions:
-VMware ESXi 7.0 without ESXi70U1b-17168206
-VMware ESXi 6.7 without ESXi670-202011101-SG update
-VMware ESXi 6.5 without ESXi650-202011301-SG update
-VMware Cloud Foundation (ESXi) 4.x earlier than 4.1.0.1
-VMware Cloud Foundation (ESXi) 3.x earlier than 3.10.1.2
-VMware Workstation Pro/Player 15.x for Windows earlier than 15.5.7
-VMware Fusion Pro / Fusion 11.x earlier than 11.5.7

More information in the VMware advisory.

VMware Horizon Server and VMware Horizon Client For Windows Updated

VMware has released updates to VMware Horizon Server and VMware Horizon Client for Windows. The new versions fix Cross Site Scripting (XSS) (CVE-2020-3997) and information disclosure security (CVE-2020-3998) vulnerabilities.

Affected versions
-VMware Horizon Server 7.x versions earlier than 7.10.3 or 7.13.0
-WMware Horizon Client for Windows earlier than 5.5.0 version

More information in the VMware security advisory.

VMware Vulnerability Fixes Available

VMware have released updated versions of their virtualization software patching security vulnerabilities (CVE-2020-3981, CVE-2020-3982, CVE-2020-3992, CVE-2020-3993, CVE-2020-3994, CVE-2020-3995)

Affected versions:

-VMware ESXi 7.0 without ESXi_7.0.1-0.0.16850804
-VMware ESXi 6.7 without ESXi670-202010401-SG update
-VMware ESXi 6.5 without ESXi650-202010401-SG update
-VMware Cloud Foundation (ESXi) 4.x earlier than 4.1
-VMware Cloud Foundation (ESXi) 3.x earlier than 3.10.1.1
-VMware Workstation Pro/Player 15.x for Windows (patch pending, check back the advisory)
-VMware Fusion Pro / Fusion 11.x earlier than 11.5.6
-NSX-T 3.x earlier than 3.0.2
-NSX-T 2.5.x earlier than 2.5.2.2.0
-VMware Cloud Foundation (NSX-T) 4.x earlier than 4.1
-VMware Cloud Foundation (NSX-T) 3.x earlier than 3.10.1.1


More information in VMware advisory here.

VMware Horizon Client For Windows Fixed

VMware have released updated version (5.5.0) of Horizon Client for Windows patching one moderate (CVE-2020-3991) categorized denial-of-service vulnerability.

Affected versions:
-Horizon Client for Windows 5.x and earlier

More information in VMware advisory here.

VMware Horizon DaaS Updated

VMware has released a new update to their Horizon DaaS software. New version fixes a broken authentication vulnerability (CVE-2020-3977). Successful exploitation of this issue may allow an attacker to bypass two-factor authentication process. In order to exploit the vulnerability an attacker must have a legitimate account on Horizon DaaS.

Affected versions:
-Horizon DaaS 7.x & 8.x

For Horizon DaaS 8.x versions there is 8.0.1 Update 1 that fixes the issue.

More information can be read from the corresponding advisory.

VMware Software Patches Available

VMware have released updated versions of their virtualization software patching security vulnerabilities (CVE-2020-3976).

Affected versions:

-VMware Workstation Pro/Player 15.x for Windows (patch pending, check back the advisory)

-VMware Fusion Pro / Fusion 11.x (patch pending, check back the advisory)

-Horizon Client for Windows 5.x versions earlier than 5.4.4

More information in VMware advisory here. 

VMware Vulnerabilities Fixed

VMware have released updated versions of their virtualization software patching a security vulnerability (CVE-2020-3976).

Affected versions:
-VMware ESXi 7.0 without ESXi_7.0.0-1.25.16324942 update
-VMware ESXi 6.7 without ESXi670-202008101-SG / ESXi670-202008401-BG update
-VMware ESXi 6.5 without ESXi650-202007401-BG / ESXi650-202007101-SG update
-VMware Cloud Foundation (ESXi) 4.x.x versions earlier than 4.0.1
-VMware Cloud Foundation (ESXi) 3.x.x versions earlier than 3.10.0
-vCenter Server 7.x versions earlier than 7.0.0b
-vCenter Server 6.7.x versions earlier than 6.7u3j
-vCenter Server 6.5.x versions earlier than 6.5u3k
-VMware Cloud Foundation (vCenter) 4.x.x versions earlier than 4.0.1
-VMware Cloud Foundation (vCenter) 3.x.x versions earlier than 3.10.1 (release pending)

More information in VMware advisory here.

VMware Updates Available

VMware have released updated versions of their virtualization software patching security vulnerabilities.

Affected versions:
-VMware ESXi 7.0 without ESXi_7.0.0-1.20.16321839 update
-VMware ESXi 6.7 without ESXi670-202004101-SG update
-VMware ESXi 6.5 without ESXi650-202005401-SG update
-VMware Workstation Pro/Player versions earlier than 15.5.5
-VMware Cloud Foundation 4.x versions earlier than 4.0.1
-VMware Cloud Foundation 3.x versions earlier than 3.10.0.1 (release of 3.10.0.1 is pending at the moment of writing this)

More information in VMware advisory here.

VMware Horizon Client For Windows Updated

VMware have released updated version (5.4.3) of Horizon Client for Windows patching one important (CVE-2020-3961) categorized privilege escalation vulnerability.

Affected versions:
-Horizon Client for Windows 5.x and earlier

More information in VMware advisory here.

VMware Vulnerabilities Fixed

VMware have released updated versions of their virtualization software patching one important (CVE-2020-3957), one moderate (CVE-2020-3958) and one low (CVE-2020-3959) categorized vulnerabilities.

Affected versions:
-VMware Workstation Pro/Player for Windows versions earlier than 15.5.2
-VMware Fusion Pro / Fusion versions earlier than 11.5.5
-ESXi 6.7 versions without patch ESXi670-202004101-SG
-ESXi 6.5 versions without patch ESXi650-202005401-SG
-Horizon Client for Windows and Mac 5.x & earlier versions (patch pending, check back the advisory)
-VMRC (VMware Remote Console) for Mac 11.x & earlier versions (patch pending, check back the advisory)

More information in VMware advisory here.

VMware ESXi Updated

VMware have released updated versions of VMware ESXi. Updates fix one important categorized cross-site scripting (XSS) vulnerability (CVE-2020-3955).

Affected versions:
-ESXi 6.7 without Patch Release ESXi670-202004103-SG
-ESXi 6.5 without Patch Release ESXi650-201912104-SG

More information in VMware advisories here.

VMware Updates Available

VMware have released updated versions of their virtualization software patching one important (CVE-2020-3950) and one low (CVE-2020-3951) categorized vulnerabilities.

Affected versions:
-VMware Workstation Pro/Player for Windows versions earlier than 15.5.2
-VMware Fusion Pro / Fusion versions earlier than 11.5.3
-Horizon Client for Windows and Mac 5.x & earlier versions before 5.4.0
-VMRC (VMware Remote Console) for Mac 11.x & earlier versions before 11.0.1

More information in VMware advisory here.