VYPR
← All advisories
Unrated severityNVD Advisory· Published Jun 25, 2020· Updated Aug 4, 2024

CVE-2020-3967

CVE-2020-3967

Description

VMware ESXi (7.0 before ESXi_7.0.0-1.20.16321839, 6.7 before ESXi670-202004101-SG and 6.5 before ESXi650-202005401-SG), Workstation (15.x before 15.5.5), and Fusion (11.x before 11.5.5) contain a heap-overflow vulnerability in the USB 2.0 controller (EHCI). A malicious actor with local access to a virtual machine may be able to exploit this vulnerability to execute code on the hypervisor from a virtual machine. Additional conditions beyond the attacker's control must be present for exploitation to be possible.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

6
  • VMware/Esxillm-fuzzy
    Range: 7.0 < ESXi_7.0.0-1.20.16321839, 6.7 < ESXi670-202004101-SG, 6.5 < ESXi650-202005401-SG
  • VMware/Fusionllm-fuzzy2 versions
    11.x before 11.5.5+ 1 more
    • (no CPE)range: 11.x before 11.5.5
    • (no CPE)range: 11.x before 11.5.5
  • VMware/Workstationllm-fuzzy2 versions
    15.x before 15.5.5+ 1 more
    • (no CPE)range: 15.x before 15.5.5
    • (no CPE)range: 15.x before 15.5.5
  • VMware/VMware ESXiv5
    Range: 7.0 before ESXi_7.0.0-1.20.16321839

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.