Vulnerabilities

VMware ESX contains an insufficient logging vulnerability.

VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS.

VMware ESXi contains an arbitrary write vulnerability.

VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds write.

VMware ESXi contains an out-of-bounds read vulnerability.

VMware ESXi contains an authentication bypass vulnerability.

The storage controllers on VMware ESXi, Workstation, and Fusion have out-of-bounds read/write vulnerability.

VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability in the UHCI USB controller.

VMware ESXi contains an out-of-bounds write vulnerability.

VMware ESXi, Workstation, and Fusion contain a use-after-free vulnerability in the UHCI USB controller.

VMware ESXi, Workstation, and Fusion contain a use-after-free vulnerability in the XHCI USB controller.

The Service Location Protocol (SLP, RFC 2608) allows an unauthenticated, remote attacker to register arbitrary services.

VMware ESXi, Workstation, and Fusion contain a heap out-of-bounds write vulnerability in the USB 2.0 controller (EHCI).

VMware ESXi contains a heap-overflow vulnerability.

VMware ESXi contains a memory corruption vulnerability that exists in the way it handles a network socket.

VMware ESXi contains a null-pointer deference vulnerability.

Aliases in the branch predictor may cause some AMD processors to predict the wrong branch type potentially leading to information disclosure.

Intel microprocessor generations 6 to 8 are affected by a new Spectre variant that is able to bypass their retpoline mitigation in the kernel to leak arbitrary data.

Incomplete cleanup in specific special register write operations for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.

Incomplete cleanup of microarchitectural fill buffers on some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.

Incomplete cleanup of multi-core shared buffers for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.

ESXi contains a slow HTTP POST denial-of-service vulnerability in rhttpproxy.

VMware ESXi contains a TOCTOU (Time-of-check Time-of-use) vulnerability that exists in the way temporary files are handled.

VMware ESXi contains an unauthorized access vulnerability due to VMX having access to settingsd authorization tickets.

VMware ESXi, Workstation, and Fusion contain a double-fetch vulnerability in the UHCI USB controller.