CVE-2020-3999: Input Validation
First published: Mon Dec 21 2020(Updated: )
VMware ESXi (7.0 prior to ESXi70U1c-17325551), VMware Workstation (16.x prior to 16.0 and 15.x prior to 15.5.7), VMware Fusion (12.x prior to 12.0 and 11.x prior to 11.5.7) and VMware Cloud Foundation contain a denial of service vulnerability due to improper input validation in GuestInfo. A malicious actor with normal user privilege access to a virtual machine can crash the virtual machine's vmx process leading to a denial of service condition.
Credit: security@vmware.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| VMware Workstation | >=15.0.0<15.5.7 | |
| VMware ESXi | >=7.0.0<esxi70u1c-17325551 | |
| VMware Fusion | >=11.5.0<11.5.7 | |
| Apple Mac OS X |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2020-3999.
What is the severity of CVE-2020-3999?
The severity of CVE-2020-3999 is medium with a severity value of 6.5.
Which software products are affected by CVE-2020-3999?
VMware ESXi (7.0 prior to ESXi70U1c-17325551), VMware Workstation (16.x prior to 16.0 and 15.x prior to 15.5.7), VMware Fusion (12.x prior to 12.0 and 11.x prior to 11.5.7) are affected by CVE-2020-3999.
What is the vulnerability in GuestInfo?
The vulnerability in CVE-2020-3999 is a denial of service vulnerability due to improper input validation in GuestInfo.
How can I fix the vulnerability CVE-2020-3999?
To fix the vulnerability CVE-2020-3999, it is recommended to update VMware ESXi to version ESXi70U1c-17325551, VMware Workstation to version 16.0 or later, VMware Fusion to version 12.0 or later, or apply the necessary patches provided by VMware.
- collector/nvd-index
- agent/severity
- agent/weakness
- agent/references
- agent/author
- agent/description
- agent/type
- agent/event
- agent/softwarecombine
- agent/first-publish-date
- agent/last-modified-date
- agent/remedy
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/vmware
- canonical/vmware workstation
- version/vmware workstation/15.0.0
- canonical/vmware esxi
- version/vmware esxi/7.0.0
- canonical/vmware fusion
- version/vmware fusion/11.5.0
- vendor/apple
- canonical/apple mac os x