CVEvulnerability
CVE-2020-3963
5.5 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2020-06-25
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 5.5 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- CVSS 2.0 ([email protected])
- 2.1 LOW — AV:L/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-416
Description
VMware ESXi (7.0 before ESXi_7.0.0-1.20.16321839, 6.7 before ESXi670-202006401-SG and 6.5 before ESXi650-202005401-SG), Workstation (15.x before 15.5.2), and Fusion (11.x before 11.5.2) contain a use-after-free vulnerability in PVNVRAM. A malicious actor with local access to a virtual machine may be able to read privileged information contained in physical memory.
Affected configurations
• vmware cloud foundation (>= 3.0 < 3.10)
• vmware cloud foundation (>= 4.0.0 < 4.0.1)
• vmware fusion (>= 11.0.0 < 11.5.2)
• vmware workstation (>= 15.0.0 < 15.5.2)
• vmware esxi 6.5
• vmware esxi 6.7
• vmware esxi 7.0.0
Related
Weakness · CWE (1)
- CWE-416 Use After Free weakness
References
- http://packetstormsecurity.com/files/158459/VMware-ESXi-Use-After-Free-Out-Of-Bounds-Access.html Exploit, Third Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2020/Jul/22 Exploit, Mailing List, Third Party Advisory
- https://www.vmware.com/security/advisories/VMSA-2020-0015.html Vendor Advisory
- http://packetstormsecurity.com/files/158459/VMware-ESXi-Use-After-Free-Out-Of-Bounds-Access.html Exploit, Third Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2020/Jul/22 Exploit, Mailing List, Third Party Advisory
- https://www.vmware.com/security/advisories/VMSA-2020-0015.html Vendor Advisory