Security Vulnerabilities fixed in VMware Workstation Player VMSA-2020-0023

Description

VMware Workstation contain an out-of-bounds write and read vulnerability due to a time-of-check time-of-use issue in ACPI device. The VMCI host drivers used by VMware hypervisors contain a memory leak vulnerability.

Outbreak Alert

ESXi servers vulnerable to the OpenSLP heap-overflow vulnerability (CVE-2021-21974) and OpenSLP remote code execution vulnerability (CVE-2020-3992) are being exploited through the OpenSLP, port 427 to deliver a new ransomware “ESXiArgs”. The ransomware encrypts files in affected ESXi servers and demand a ransom for file decryption.

View the full Outbreak Alert Report

Affected Applications

VMware Workstation Player

CVE References

CVE-2020-3981 CVE-2020-3982 CVE-2020-3995

Other References

http://www.vmware.com/security/advisories/VMSA-2020-0023.html