CVE-2020-3951: Low severity VMware Horizon Client vulnerability
VMware Workstation (15.x before 15.5.2) and Horizon Client for Windows (5.x and prior before 5.4.0) contain a denial-of-service vulnerability due to a heap-overflow issue in Cortado Thinprint. Attackers with non-administrative access to a guest VM with virtual printing enabled may exploit this issue to create a denial-of-service condition of the Thinprint service running on the system where Workstation or Horizon Client is installed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
VMware Workstationto a version that resolves this vulnerability.Fixed in 15.5.2 - Upgrade
Upgrade
Horizon Client for Windowsto a version that resolves this vulnerability.Fixed in 5.4.0
Event History
Frequently Asked Questions
What is CVE-2020-3951?
CVE-2020-3951 is a denial-of-service vulnerability in VMware Workstation and Horizon Client for Windows.
What is the severity of CVE-2020-3951?
CVE-2020-3951 has a severity value of 3.8 which is considered low.
Which software products are affected by CVE-2020-3951?
VMware Workstation (before version 15.5.2) and Horizon Client for Windows (before version 5.4.0) are affected by CVE-2020-3951.
How can attackers exploit CVE-2020-3951?
Attackers with non-administrative access to a guest VM with virtual printing enabled can exploit CVE-2020-3951.
How can I fix CVE-2020-3951?
Update VMware Workstation to version 15.5.2 or later and Horizon Client for Windows to version 5.4.0 or later to fix CVE-2020-3951.