CVE-2020-3957
First published: Fri May 29 2020(Updated: )
VMware Fusion (11.x before 11.5.5), VMware Remote Console for Mac (11.x and prior) and VMware Horizon Client for Mac (5.x and prior) contain a local privilege escalation vulnerability due to a Time-of-check Time-of-use (TOCTOU) issue in the service opener. Successful exploitation of this issue may allow attackers with normal user privileges to escalate their privileges to root on the system where Fusion, VMRC and Horizon Client are installed.
Credit: security@vmware.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| VMware Fusion | >=11.0.0<11.5.5 | |
| Vmware Horizon Client | <=5.4.0 | |
| VMware Remote Console | <=11.0.1 | |
| Apple macOS |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2020-3957.
What is the severity of CVE-2020-3957?
The severity of CVE-2020-3957 is high (7 out of 10).
Which software versions are affected by CVE-2020-3957?
VMware Fusion versions 11.x before 11.5.5, VMware Remote Console for Mac versions 11.x and prior, and VMware Horizon Client for Mac versions 5.x and prior are affected by CVE-2020-3957.
How can this vulnerability be exploited?
This vulnerability can be exploited through a Time-of-check Time-of-use (TOCTOU) issue in the service opener.
Is Apple macOS affected by CVE-2020-3957?
No, Apple macOS is not affected by CVE-2020-3957.
- agent/type
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/references
- agent/weakness
- agent/severity
- agent/tags
- agent/author
- agent/description
- agent/event
- collector/mitre-cve
- source/MITRE
- vendor/vmware
- canonical/vmware fusion
- version/vmware fusion/11.0.0
- canonical/vmware horizon client
- version/vmware horizon client/5.4.0
- canonical/vmware remote console
- version/vmware remote console/11.0.1
- vendor/apple
- canonical/apple macos