CVE-2020-3986
VMware Workstation ThinPrint EMF Out-Of-Bounds Read Information Disclosure Vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
VMware Workstation (15.x) and Horizon Client for Windows (5.x before 5.4.4) contain an out-of-bounds read vulnerability in Cortado ThinPrint component (EMF Parser). A malicious actor with normal access to a virtual machine may be able to exploit these issues to create a partial denial-of-service condition or to leak memory from TPView process running on the system where Workstation or Horizon Client for Windows is installed.
VMware Workstation (versión 15.x) y Horizon Client para Windows (versión 5.x anteriores a 5.4.4), contienen una vulnerabilidad de lectura fuera de límites en el componente Cortado ThinPrint (Analizador EMF). Un actor malicioso con acceso normal a una máquina virtual puede explotar estos problemas para crear una condición de denegación de servicio parcial o para filtrar la memoria del proceso TPView que se ejecuta en el sistema donde está instalado Workstation o Horizon Client para Windows
This vulnerability allows local attackers to disclose sensitive information on affected installations of VMware Workstation. An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this vulnerability.
The specific flaw exists within the parsing of EMF files in the ThinPrint component. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute code in the context of the hypervisor.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2019-12-30 CVE Reserved
- 2020-09-15 CVE Published
- 2023-03-08 EPSS Updated
- 2024-08-04 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-125: Out-of-bounds Read
CAPEC
References (1)
URL | Tag | Source |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
https://www.vmware.com/security/advisories/VMSA-2020-0020.html | 2020-09-28 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Vmware Search vendor "Vmware" | Horizon Client Search vendor "Vmware" for product "Horizon Client" | >= 5.0.0 < 5.4.4 Search vendor "Vmware" for product "Horizon Client" and version " >= 5.0.0 < 5.4.4" | windows |
Affected
| ||||||
Vmware Search vendor "Vmware" | Workstation Player Search vendor "Vmware" for product "Workstation Player" | >= 15.0.0 < 16.0.0 Search vendor "Vmware" for product "Workstation Player" and version " >= 15.0.0 < 16.0.0" | - |
Affected
| ||||||
Vmware Search vendor "Vmware" | Workstation Pro Search vendor "Vmware" for product "Workstation Pro" | >= 15.0.0 < 16.0.0 Search vendor "Vmware" for product "Workstation Pro" and version " >= 15.0.0 < 16.0.0" | - |
Affected
|