Vulnerability Description
VMware ESXi (7.0 prior to ESXi70U1c-17325551), VMware Workstation (16.x prior to 16.0 and 15.x prior to 15.5.7), VMware Fusion (12.x prior to 12.0 and 11.x prior to 11.5.7) and VMware Cloud Foundation contain a denial of service vulnerability due to improper input validation in GuestInfo. A malicious actor with normal user privilege access to a virtual machine can crash the virtual machine's vmx process leading to a denial of service condition.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Vmware | Workstation | >= 15.0.0, < 15.5.7 |
| Vmware | Esxi | 7.0 |
| Vmware | Fusion | >= 11.5.0, < 11.5.7 |
| Apple | Mac Os X | - |
Related Weaknesses (CWE)
References
- https://www.vmware.com/security/advisories/VMSA-2020-0029.htmlPatchVendor Advisory
- https://www.vmware.com/security/advisories/VMSA-2020-0029.htmlPatchVendor Advisory
FAQ
What is CVE-2020-3999?
CVE-2020-3999 is a vulnerability with a CVSS score of 6.5 (MEDIUM). VMware ESXi (7.0 prior to ESXi70U1c-17325551), VMware Workstation (16.x prior to 16.0 and 15.x prior to 15.5.7), VMware Fusion (12.x prior to 12.0 and 11.x prior to 11.5.7) and VMware Cloud Foundation...
How severe is CVE-2020-3999?
CVE-2020-3999 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-3999?
Check the references section above for vendor advisories and patch information. Affected products include: Vmware Workstation, Vmware Esxi, Vmware Fusion, Apple Mac Os X.