{"id":4244,"date":"2023-04-27T02:00:18","date_gmt":"2023-04-27T01:00:18","guid":{"rendered":"https:\/\/www.sebae.net\/blog\/vmsa-2023-0008\/"},"modified":"2023-04-27T02:00:18","modified_gmt":"2023-04-27T01:00:18","slug":"vmsa-2023-0008","status":"publish","type":"post","link":"https:\/\/www.sebae.net\/blog\/vmsa-2023-0008\/","title":{"rendered":"VMSA-2023-0008"},"content":{"rendered":"<div>\n<div class=\"aem-Grid aem-Grid--12 aem-Grid--default--12 \">\n<div class=\"responsivegrid aem-GridColumn aem-GridColumn--default--12\">\n<div class=\"aem-Grid aem-Grid--12 aem-Grid--default--12 \">\n<div class=\"advisories-summary aem-GridColumn aem-GridColumn--default--12\">\n    <link rel=\"stylesheet\" href=\"\/etc.clientlibs\/vmware-modernize-cms\/componentlibrary\/components\/content\/advisories-summary\/clientlibs.min.css\" type=\"text\/css\">\n<section class=\"sa-detail-wrapper section-custom\">\n<div class=\"container\">\n<div class=\"content\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n<div class=\"sa-image-block\">\n<div class=\"sa-severity\">\n<div class=\"sa-critical\">\n<p>Critical<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"sa-detail-block\">\n<div class=\"col-md-8\">\n<div class=\"sa-details\">\n<div class=\"sa-row-group\">\n             <label>Advisory ID:<\/label><br \/>\n             <span>VMSA-2023-0008<\/span>\n            <\/div>\n<div class=\"sa-row-group\">\n             <label>CVSSv3 Range:<\/label><br \/>\n             <span>7.3-9.3<\/span>\n            <\/div>\n<div class=\"sa-row-group\">\n             <label>Issue Date:<\/label><br \/>\n             <span>2023-04-25<\/span>\n            <\/div>\n<div class=\"sa-row-group\">\n             <label>Updated On:<\/label><br \/>\n             <span>2023-04-25 (Initial Advisory)<\/span>\n            <\/div>\n<div class=\"sa-row-group\">\n             <label>CVE(s): <\/label><br \/>\n             <span>CVE-2023-20869, CVE-2023-20870, CVE-2023-20871, CVE-2023-20872<\/span>\n            <\/div>\n<div class=\"sa-row-group\">\n             <label>Synopsis:<\/label><br \/>\n             <span>VMware Workstation and Fusion updates address multiple security vulnerabilities (CVE-2023-20869, CVE-2023-20870, CVE-2023-20871, CVE-2023-20872)<\/span>\n            <\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"col-md-4 sa-summary-link-section\" data-html2canvas-ignore=\"true\">\n          <\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/section><\/div>\n<div class=\"secadvheading aem-GridColumn aem-GridColumn--default--12\">\n    <link rel=\"stylesheet\" href=\"\/etc.clientlibs\/vmware-modernize-cms\/componentlibrary\/components\/content\/secadvheading\/clientlibs.min.css\" type=\"text\/css\">\n<section class=\"section-custom\">\n<div class=\"container\">\n<div class=\"content\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n<h5 id=\"1-impacted-products\" class=\"mt-30\"><b>1. Impacted Products<\/b><\/h5>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/section><\/div>\n<div class=\"text aem-GridColumn aem-GridColumn--default--12\">\n<div class=\"cmp-text     \">\n<div class=\"nested-filtered-table active\">\n<div class=\"container\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n         <input type=\"hidden\" class=\"ExpandLabel\"><br \/>\n         <input type=\"hidden\" class=\"CollapseLabel\"><br \/>\n         <input type=\"hidden\" class=\"BrightcoveAccountID\"> <\/p>\n<div class=\"container text-container\" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<div class=\"row\">\n<div class=\"col-md-12 no-padd \" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<ul>\n<li>VMware Workstation Pro \/ Player (Workstation)<\/li>\n<li>VMware Fusion\u00a0 \u00a0<\/li>\n<\/ul><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"secadvheading aem-GridColumn aem-GridColumn--default--12\">\n<section class=\"section-custom\">\n<div class=\"container\">\n<div class=\"content\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n<h5 id=\"2-introduction\" class=\"mt-30\"><b>2. Introduction<\/b><\/h5>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/section><\/div>\n<div class=\"text aem-GridColumn aem-GridColumn--default--12\">\n<div class=\"cmp-text     \">\n<div class=\"nested-filtered-table active\">\n<div class=\"container\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n         <input type=\"hidden\" class=\"ExpandLabel\"><br \/>\n         <input type=\"hidden\" class=\"CollapseLabel\"><br \/>\n         <input type=\"hidden\" class=\"BrightcoveAccountID\"> <\/p>\n<div class=\"container text-container\" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<div class=\"row\">\n<div class=\"col-md-12 no-padd \" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<p>Multiple security vulnerabilities in VMware Workstation and Fusion were privately reported to VMware. Updates and workarounds are available to remediate these vulnerabilities in the affected VMware products.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"secadvheading aem-GridColumn aem-GridColumn--default--12\">\n<section class=\"section-custom\">\n<div class=\"container\">\n<div class=\"content\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n<h5 id=\"3a-stack-based-buffer-overflow-vulnerability-in-bluetooth-device-sharing-functionality-cve-2023-20869\" class=\"mt-30\"><b>3a. Stack-based buffer-overflow vulnerability in bluetooth device-sharing functionality (CVE-2023-20869)<\/b><\/h5>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/section><\/div>\n<div class=\"secadvheading aem-GridColumn aem-GridColumn--default--12\">\n<section class=\"section-custom\">\n<div class=\"container\">\n<div class=\"content\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n<p class=\"mt-15\"><b>Description<\/b><\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/section><\/div>\n<div class=\"text aem-GridColumn aem-GridColumn--default--12\">\n<div class=\"cmp-text     \">\n<div class=\"nested-filtered-table active\">\n<div class=\"container\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n         <input type=\"hidden\" class=\"ExpandLabel\"><br \/>\n         <input type=\"hidden\" class=\"CollapseLabel\"><br \/>\n         <input type=\"hidden\" class=\"BrightcoveAccountID\"> <\/p>\n<div class=\"container text-container\" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<div class=\"row\">\n<div class=\"col-md-12 no-padd \" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<p>VMware Workstation and Fusion contain a stack-based buffer-overflow vulnerability that exists in the functionality for sharing host Bluetooth devices with the virtual machine. VMware has evaluated the severity of this issue to be in the\u00a0<a href=\"https:\/\/www.vmware.com\/support\/policies\/security_response.html\">Critical severity range<\/a>\u00a0with a maximum CVSSv3 base score of\u00a0<a href=\"https:\/\/www.first.org\/cvss\/calculator\/3.1#CVSS:3.1\/AV:L\/AC:L\/PR:N\/UI:N\/S:C\/C:H\/I:H\/A:H\">9.3<\/a>.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"secadvheading aem-GridColumn aem-GridColumn--default--12\">\n<section class=\"section-custom\">\n<div class=\"container\">\n<div class=\"content\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n<p class=\"mt-15\"><b>Known Attack Vectors<\/b><\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/section><\/div>\n<div class=\"text aem-GridColumn aem-GridColumn--default--12\">\n<div class=\"cmp-text     \">\n<div class=\"nested-filtered-table active\">\n<div class=\"container\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n         <input type=\"hidden\" class=\"ExpandLabel\"><br \/>\n         <input type=\"hidden\" class=\"CollapseLabel\"><br \/>\n         <input type=\"hidden\" class=\"BrightcoveAccountID\"> <\/p>\n<div class=\"container text-container\" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<div class=\"row\">\n<div class=\"col-md-12 no-padd \" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<p>A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine&#8217;s VMX process running on the host.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"secadvheading aem-GridColumn aem-GridColumn--default--12\">\n<section class=\"section-custom\">\n<div class=\"container\">\n<div class=\"content\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n<p class=\"mt-15\"><b>Resolution<\/b><\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/section><\/div>\n<div class=\"text aem-GridColumn aem-GridColumn--default--12\">\n<div class=\"cmp-text     \">\n<div class=\"nested-filtered-table active\">\n<div class=\"container\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n         <input type=\"hidden\" class=\"ExpandLabel\"><br \/>\n         <input type=\"hidden\" class=\"CollapseLabel\"><br \/>\n         <input type=\"hidden\" class=\"BrightcoveAccountID\"> <\/p>\n<div class=\"container text-container\" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<div class=\"row\">\n<div class=\"col-md-12 no-padd \" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<p>To remediate CVE-2023-20869\u00a0update to the version listed in the &#8216;Fixed Version&#8217; column of the &#8216;Response Matrix&#8217; found below.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"secadvheading aem-GridColumn aem-GridColumn--default--12\">\n<section class=\"section-custom\">\n<div class=\"container\">\n<div class=\"content\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n<p class=\"mt-15\"><b>Workarounds<\/b><\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/section><\/div>\n<div class=\"text aem-GridColumn aem-GridColumn--default--12\">\n<div class=\"cmp-text     \">\n<div class=\"nested-filtered-table active\">\n<div class=\"container\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n         <input type=\"hidden\" class=\"ExpandLabel\"><br \/>\n         <input type=\"hidden\" class=\"CollapseLabel\"><br \/>\n         <input type=\"hidden\" class=\"BrightcoveAccountID\"> <\/p>\n<div class=\"container text-container\" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<div class=\"row\">\n<div class=\"col-md-12 no-padd \" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<p>Workarounds for CVE-2023-20869 have been listed in the &#8216;Workarounds&#8217; column of the &#8216;Response Matrix&#8217; below.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"secadvheading aem-GridColumn aem-GridColumn--default--12\">\n<section class=\"section-custom\">\n<div class=\"container\">\n<div class=\"content\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n<p class=\"mt-15\"><b>Additional Documentation<\/b><\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/section><\/div>\n<div class=\"text aem-GridColumn aem-GridColumn--default--12\">\n<div class=\"cmp-text     \">\n<div class=\"nested-filtered-table active\">\n<div class=\"container\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n         <input type=\"hidden\" class=\"ExpandLabel\"><br \/>\n         <input type=\"hidden\" class=\"CollapseLabel\"><br \/>\n         <input type=\"hidden\" class=\"BrightcoveAccountID\"> <\/p>\n<div class=\"container text-container\" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<div class=\"row\">\n<div class=\"col-md-12 no-padd \" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<p>None.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"secadvheading aem-GridColumn aem-GridColumn--default--12\">\n<section class=\"section-custom\">\n<div class=\"container\">\n<div class=\"content\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n<p class=\"mt-15\"><b>Notes<\/b><\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/section><\/div>\n<div class=\"text aem-GridColumn aem-GridColumn--default--12\">\n<div class=\"cmp-text     \">\n<div class=\"nested-filtered-table active\">\n<div class=\"container\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n         <input type=\"hidden\" class=\"ExpandLabel\"><br \/>\n         <input type=\"hidden\" class=\"CollapseLabel\"><br \/>\n         <input type=\"hidden\" class=\"BrightcoveAccountID\"> <\/p>\n<div class=\"container text-container\" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<div class=\"row\">\n<div class=\"col-md-12 no-padd \" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<p>None.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"secadvheading aem-GridColumn aem-GridColumn--default--12\">\n<section class=\"section-custom\">\n<div class=\"container\">\n<div class=\"content\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n<p class=\"mt-15\"><b>Acknowledgements<\/b><\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/section><\/div>\n<div class=\"text aem-GridColumn aem-GridColumn--default--12\">\n<div class=\"cmp-text     \">\n<div class=\"nested-filtered-table active\">\n<div class=\"container\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n         <input type=\"hidden\" class=\"ExpandLabel\"><br \/>\n         <input type=\"hidden\" class=\"CollapseLabel\"><br \/>\n         <input type=\"hidden\" class=\"BrightcoveAccountID\"> <\/p>\n<div class=\"container text-container\" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<div class=\"row\">\n<div class=\"col-md-12 no-padd \" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<p>VMware would like to thank STAR Labs, working with the Pwn2Own 2023 Security Contest, for reporting this issue to us.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"secadvheading aem-GridColumn aem-GridColumn--default--12\">\n<section class=\"section-custom\">\n<div class=\"container\">\n<div class=\"content\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n<p class=\"mt-15\"><b>Response Matrix<\/b><\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/section><\/div>\n<div class=\"advisories-data aem-GridColumn aem-GridColumn--default--12\">\n    <link rel=\"stylesheet\" href=\"\/etc.clientlibs\/vmware-modernize-cms\/componentlibrary\/components\/content\/advisories-data\/clientlibs.min.css\" type=\"text\/css\">\n<section class=\"response-matrix\">\n<div class=\"container\">\n<div class=\"content\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n<div class=\"section-custom\">\n<div class=\"table-responsive\">\n<table class=\"table\">\n<tbody>\n<tr class=\"tr thead\">\n<td class=\"td\">Product<\/td>\n<td class=\"td\">Version<\/td>\n<td class=\"td\">Running On<\/td>\n<td class=\"td\">CVE Identifier<\/td>\n<td class=\"td\">CVSSv3<\/td>\n<td class=\"td\">Severity<\/td>\n<td class=\"td\">Fixed Version<\/td>\n<td class=\"td\">Workarounds<\/td>\n<td class=\"td\">Additional Documentation<\/td>\n<\/tr>\n<tr class=\"tr\">\n<td class=\"td\" data-th=\"Product\">\n<div class=\"td-content\">\n                Workstation\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"Version\">\n<div class=\"td-content\">\n                17.x\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"Running On\">\n<div class=\"td-content\">\n                Any\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"CVE Identifier\">\n<div class=\"td-content\">\n                CVE-2023-20869\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"CVSSV3\">\n<div class=\"td-content\">\n                <a aria-label=\"9.3\" href=\"https:\/\/www.first.org\/cvss\/calculator\/3.1#CVSS:3.1\/AV:L\/AC:L\/PR:N\/UI:N\/S:C\/C:H\/I:H\/A:H\">9.3<\/a>\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"Severity\">\n<div class=\"td-content\">\n<div class=\"sa-severity-blk\">\n                 critical\n                <\/div>\n<p>                <span class=\"sa-severity sa-critical\"><\/span>\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"Fixed Version\">\n<div class=\"td-content\">\n                17.0.2\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"Workarounds\">\n<div class=\"td-content\">\n                <a aria-label=\"KB91760\" href=\"https:\/\/kb.vmware.com\/s\/article\/91760\">KB91760<\/a>\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"Additional Documents\">\n<div class=\"td-content\">\n                None\n               <\/div>\n<\/td>\n<\/tr>\n<tr class=\"tr\">\n<td class=\"td\" data-th=\"Product\">\n<div class=\"td-content\">\n                Fusion\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"Version\">\n<div class=\"td-content\">\n                13.x\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"Running On\">\n<div class=\"td-content\">\n                OS X\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"CVE Identifier\">\n<div class=\"td-content\">\n                CVE-2023-20869\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"CVSSV3\">\n<div class=\"td-content\">\n                <a aria-label=\"9.3\" href=\"https:\/\/www.first.org\/cvss\/calculator\/3.1#CVSS:3.1\/AV:L\/AC:L\/PR:N\/UI:N\/S:C\/C:H\/I:H\/A:H\">9.3<\/a>\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"Severity\">\n<div class=\"td-content\">\n<div class=\"sa-severity-blk\">\n                 critical\n                <\/div>\n<p>                <span class=\"sa-severity sa-critical\"><\/span>\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"Fixed Version\">\n<div class=\"td-content\">\n                13.0.2\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"Workarounds\">\n<div class=\"td-content\">\n                <a aria-label=\"KB91760\" href=\"https:\/\/kb.vmware.com\/s\/article\/91760\">KB91760<\/a>\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"Additional Documents\">\n<div class=\"td-content\">\n                None\n               <\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/section><\/div>\n<div class=\"secadvheading aem-GridColumn aem-GridColumn--default--12\">\n<section class=\"section-custom\">\n<div class=\"container\">\n<div class=\"content\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n<h5 id=\"3b-information-disclosure-vulnerability-in-bluetooth-device-sharing-functionality-cve-2023-20870\" class=\"mt-30\"><b>3b. Information disclosure vulnerability in bluetooth device-sharing functionality (CVE-2023-20870)<\/b><\/h5>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/section><\/div>\n<div class=\"secadvheading aem-GridColumn aem-GridColumn--default--12\">\n<section class=\"section-custom\">\n<div class=\"container\">\n<div class=\"content\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n<p class=\"mt-15\"><b>Description<\/b><\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/section><\/div>\n<div class=\"text aem-GridColumn aem-GridColumn--default--12\">\n<div class=\"cmp-text     \">\n<div class=\"nested-filtered-table active\">\n<div class=\"container\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n         <input type=\"hidden\" class=\"ExpandLabel\"><br \/>\n         <input type=\"hidden\" class=\"CollapseLabel\"><br \/>\n         <input type=\"hidden\" class=\"BrightcoveAccountID\"> <\/p>\n<div class=\"container text-container\" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<div class=\"row\">\n<div class=\"col-md-12 no-padd \" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<p>VMware Workstation and Fusion contain an out-of-bounds read vulnerability that exists in the functionality for sharing host Bluetooth devices with the virtual machine. VMware has evaluated the severity of this issue to be in the\u00a0<a href=\"https:\/\/www.vmware.com\/support\/policies\/security_response.html\">Important severity range<\/a>\u00a0with a maximum CVSSv3 base score of\u00a0<a href=\"https:\/\/www.first.org\/cvss\/calculator\/3.1#CVSS:3.1\/AV:L\/AC:L\/PR:N\/UI:N\/S:C\/C:H\/I:N\/A:N\">7.1<\/a>.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"secadvheading aem-GridColumn aem-GridColumn--default--12\">\n<section class=\"section-custom\">\n<div class=\"container\">\n<div class=\"content\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n<p class=\"mt-15\"><b>Known Attack Vectors<\/b><\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/section><\/div>\n<div class=\"text aem-GridColumn aem-GridColumn--default--12\">\n<div class=\"cmp-text     \">\n<div class=\"nested-filtered-table active\">\n<div class=\"container\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n         <input type=\"hidden\" class=\"ExpandLabel\"><br \/>\n         <input type=\"hidden\" class=\"CollapseLabel\"><br \/>\n         <input type=\"hidden\" class=\"BrightcoveAccountID\"> <\/p>\n<div class=\"container text-container\" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<div class=\"row\">\n<div class=\"col-md-12 no-padd \" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<p>A malicious actor with local administrative privileges\u00a0on a virtual machine may be able to read privileged information contained in hypervisor memory from a virtual machine.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"secadvheading aem-GridColumn aem-GridColumn--default--12\">\n<section class=\"section-custom\">\n<div class=\"container\">\n<div class=\"content\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n<p class=\"mt-15\"><b>Resolution<\/b><\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/section><\/div>\n<div class=\"text aem-GridColumn aem-GridColumn--default--12\">\n<div class=\"cmp-text     \">\n<div class=\"nested-filtered-table active\">\n<div class=\"container\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n         <input type=\"hidden\" class=\"ExpandLabel\"><br \/>\n         <input type=\"hidden\" class=\"CollapseLabel\"><br \/>\n         <input type=\"hidden\" class=\"BrightcoveAccountID\"> <\/p>\n<div class=\"container text-container\" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<div class=\"row\">\n<div class=\"col-md-12 no-padd \" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<p>To remediate CVE-2023-20870 update to the version listed in the &#8216;Fixed Version&#8217; column of the &#8216;Response Matrix&#8217; found below.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"secadvheading aem-GridColumn aem-GridColumn--default--12\">\n<section class=\"section-custom\">\n<div class=\"container\">\n<div class=\"content\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n<p class=\"mt-15\"><b>Workarounds<\/b><\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/section><\/div>\n<div class=\"text aem-GridColumn aem-GridColumn--default--12\">\n<div class=\"cmp-text     \">\n<div class=\"nested-filtered-table active\">\n<div class=\"container\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n         <input type=\"hidden\" class=\"ExpandLabel\"><br \/>\n         <input type=\"hidden\" class=\"CollapseLabel\"><br \/>\n         <input type=\"hidden\" class=\"BrightcoveAccountID\"> <\/p>\n<div class=\"container text-container\" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<div class=\"row\">\n<div class=\"col-md-12 no-padd \" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<p>Workarounds for CVE-2023-20870 have been listed in the &#8216;Workarounds&#8217; column of the &#8216;Response Matrix&#8217; below.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"secadvheading aem-GridColumn aem-GridColumn--default--12\">\n<section class=\"section-custom\">\n<div class=\"container\">\n<div class=\"content\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n<p class=\"mt-15\"><b>Additional Documentation<\/b><\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/section><\/div>\n<div class=\"text aem-GridColumn aem-GridColumn--default--12\">\n<div class=\"cmp-text     \">\n<div class=\"nested-filtered-table active\">\n<div class=\"container\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n         <input type=\"hidden\" class=\"ExpandLabel\"><br \/>\n         <input type=\"hidden\" class=\"CollapseLabel\"><br \/>\n         <input type=\"hidden\" class=\"BrightcoveAccountID\"> <\/p>\n<div class=\"container text-container\" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<div class=\"row\">\n<div class=\"col-md-12 no-padd \" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<p>None.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"secadvheading aem-GridColumn aem-GridColumn--default--12\">\n<section class=\"section-custom\">\n<div class=\"container\">\n<div class=\"content\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n<p class=\"mt-15\"><b>Notes<\/b><\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/section><\/div>\n<div class=\"text aem-GridColumn aem-GridColumn--default--12\">\n<div class=\"cmp-text     \">\n<div class=\"nested-filtered-table active\">\n<div class=\"container\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n         <input type=\"hidden\" class=\"ExpandLabel\"><br \/>\n         <input type=\"hidden\" class=\"CollapseLabel\"><br \/>\n         <input type=\"hidden\" class=\"BrightcoveAccountID\"> <\/p>\n<div class=\"container text-container\" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<div class=\"row\">\n<div class=\"col-md-12 no-padd \" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<p>None.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"secadvheading aem-GridColumn aem-GridColumn--default--12\">\n<section class=\"section-custom\">\n<div class=\"container\">\n<div class=\"content\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n<p class=\"mt-15\"><b>Acknowledgements<\/b><\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/section><\/div>\n<div class=\"text aem-GridColumn aem-GridColumn--default--12\">\n<div class=\"cmp-text     \">\n<div class=\"nested-filtered-table active\">\n<div class=\"container\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n         <input type=\"hidden\" class=\"ExpandLabel\"><br \/>\n         <input type=\"hidden\" class=\"CollapseLabel\"><br \/>\n         <input type=\"hidden\" class=\"BrightcoveAccountID\"> <\/p>\n<div class=\"container text-container\" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<div class=\"row\">\n<div class=\"col-md-12 no-padd \" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<p>VMware would like to thank STAR Labs, working with the Pwn2Own 2023 Security Contest, for reporting this issue to us.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"secadvheading aem-GridColumn aem-GridColumn--default--12\">\n<section class=\"section-custom\">\n<div class=\"container\">\n<div class=\"content\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n<p class=\"mt-15\"><b>Response Matrix<\/b><\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/section><\/div>\n<div class=\"advisories-data aem-GridColumn aem-GridColumn--default--12\">\n<section class=\"response-matrix\">\n<div class=\"container\">\n<div class=\"content\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n<div class=\"section-custom\">\n<div class=\"table-responsive\">\n<table class=\"table\">\n<tbody>\n<tr class=\"tr thead\">\n<td class=\"td\">Product<\/td>\n<td class=\"td\">Version<\/td>\n<td class=\"td\">Running On<\/td>\n<td class=\"td\">CVE Identifier<\/td>\n<td class=\"td\">CVSSv3<\/td>\n<td class=\"td\">Severity<\/td>\n<td class=\"td\">Fixed Version<\/td>\n<td class=\"td\">Workarounds<\/td>\n<td class=\"td\">Additional Documentation<\/td>\n<\/tr>\n<tr class=\"tr\">\n<td class=\"td\" data-th=\"Product\">\n<div class=\"td-content\">\n                Workstation\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"Version\">\n<div class=\"td-content\">\n                17.x\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"Running On\">\n<div class=\"td-content\">\n                Any\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"CVE Identifier\">\n<div class=\"td-content\">\n                CVE-2023-20870\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"CVSSV3\">\n<div class=\"td-content\">\n                <a aria-label=\"7.1\" href=\"https:\/\/www.first.org\/cvss\/calculator\/3.1#CVSS:3.1\/AV:L\/AC:L\/PR:N\/UI:N\/S:C\/C:H\/I:N\/A:N\">7.1<\/a>\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"Severity\">\n<div class=\"td-content\">\n<div class=\"sa-severity-blk\">\n                 important\n                <\/div>\n<p>                <span class=\"sa-severity sa-important\"><\/span>\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"Fixed Version\">\n<div class=\"td-content\">\n                17.0.2\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"Workarounds\">\n<div class=\"td-content\">\n                <a aria-label=\"KB91760\" href=\"https:\/\/kb.vmware.com\/s\/article\/91760\">KB91760<\/a>\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"Additional Documents\">\n<div class=\"td-content\">\n                None\n               <\/div>\n<\/td>\n<\/tr>\n<tr class=\"tr\">\n<td class=\"td\" data-th=\"Product\">\n<div class=\"td-content\">\n                Fusion\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"Version\">\n<div class=\"td-content\">\n                13.x\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"Running On\">\n<div class=\"td-content\">\n                OS X\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"CVE Identifier\">\n<div class=\"td-content\">\n                CVE-2023-20870\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"CVSSV3\">\n<div class=\"td-content\">\n                <a aria-label=\"7.1\" href=\"https:\/\/www.first.org\/cvss\/calculator\/3.1#CVSS:3.1\/AV:L\/AC:L\/PR:N\/UI:N\/S:C\/C:H\/I:N\/A:N\">7.1<\/a>\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"Severity\">\n<div class=\"td-content\">\n<div class=\"sa-severity-blk\">\n                 important\n                <\/div>\n<p>                <span class=\"sa-severity sa-important\"><\/span>\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"Fixed Version\">\n<div class=\"td-content\">\n                13.0.2\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"Workarounds\">\n<div class=\"td-content\">\n                <a aria-label=\"KB91760\" href=\"https:\/\/kb.vmware.com\/s\/article\/91760\">KB91760<\/a>\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"Additional Documents\">\n<div class=\"td-content\">\n                None\n               <\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/section><\/div>\n<div class=\"secadvheading aem-GridColumn aem-GridColumn--default--12\">\n<section class=\"section-custom\">\n<div class=\"container\">\n<div class=\"content\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n<h5 id=\"3c-vmware-fusion-raw-disk-local-privilege-escalation-vulnerability-cve-2023-20871\" class=\"mt-30\"><b>3c. VMware Fusion Raw Disk local privilege escalation vulnerability (CVE-2023-20871) <\/b><\/h5>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/section><\/div>\n<div class=\"secadvheading aem-GridColumn aem-GridColumn--default--12\">\n<section class=\"section-custom\">\n<div class=\"container\">\n<div class=\"content\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n<p class=\"mt-15\"><b>Description<\/b><\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/section><\/div>\n<div class=\"text aem-GridColumn aem-GridColumn--default--12\">\n<div class=\"cmp-text     \">\n<div class=\"nested-filtered-table active\">\n<div class=\"container\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n         <input type=\"hidden\" class=\"ExpandLabel\"><br \/>\n         <input type=\"hidden\" class=\"CollapseLabel\"><br \/>\n         <input type=\"hidden\" class=\"BrightcoveAccountID\"> <\/p>\n<div class=\"container text-container\" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<div class=\"row\">\n<div class=\"col-md-12 no-padd \" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<p>VMware\u00a0Fusion contains a\u00a0local\u00a0privilege escalation\u00a0vulnerability. VMware has evaluated the severity of this issue to be in the\u00a0<a href=\"https:\/\/www.vmware.com\/support\/policies\/security_response.html\">Important severity range<\/a>\u00a0with a maximum CVSSv3 base score of\u00a0<a href=\"https:\/\/www.first.org\/cvss\/calculator\/3.1#CVSS:3.1\/AV:L\/AC:L\/PR:L\/UI:N\/S:U\/C:H\/I:L\/A:H\">7.3<\/a><a href=\"https:\/\/www.first.org\/cvss\/calculator\/3.1#CVSS:3.1\/AV:L\/AC:L\/PR:H\/UI:N\/S:U\/C:H\/I:N\/A:N\">.<\/a><\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"secadvheading aem-GridColumn aem-GridColumn--default--12\">\n<section class=\"section-custom\">\n<div class=\"container\">\n<div class=\"content\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n<p class=\"mt-15\"><b>Known Attack Vectors<\/b><\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/section><\/div>\n<div class=\"text aem-GridColumn aem-GridColumn--default--12\">\n<div class=\"cmp-text     \">\n<div class=\"nested-filtered-table active\">\n<div class=\"container\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n         <input type=\"hidden\" class=\"ExpandLabel\"><br \/>\n         <input type=\"hidden\" class=\"CollapseLabel\"><br \/>\n         <input type=\"hidden\" class=\"BrightcoveAccountID\"> <\/p>\n<div class=\"container text-container\" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<div class=\"row\">\n<div class=\"col-md-12 no-padd \" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<p>A malicious actor with read\/write access to the host operating system can elevate privileges to gain root access to the host operating system.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"secadvheading aem-GridColumn aem-GridColumn--default--12\">\n<section class=\"section-custom\">\n<div class=\"container\">\n<div class=\"content\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n<p class=\"mt-15\"><b>Resolution<\/b><\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/section><\/div>\n<div class=\"text aem-GridColumn aem-GridColumn--default--12\">\n<div class=\"cmp-text     \">\n<div class=\"nested-filtered-table active\">\n<div class=\"container\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n         <input type=\"hidden\" class=\"ExpandLabel\"><br \/>\n         <input type=\"hidden\" class=\"CollapseLabel\"><br \/>\n         <input type=\"hidden\" class=\"BrightcoveAccountID\"> <\/p>\n<div class=\"container text-container\" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<div class=\"row\">\n<div class=\"col-md-12 no-padd \" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<p>To remediate CVE-2023-20871 update to the version listed in the &#8216;Fixed Version&#8217; column of the &#8216;Response Matrix&#8217; found below.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"secadvheading aem-GridColumn aem-GridColumn--default--12\">\n<section class=\"section-custom\">\n<div class=\"container\">\n<div class=\"content\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n<p class=\"mt-15\"><b>Workarounds<\/b><\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/section><\/div>\n<div class=\"text aem-GridColumn aem-GridColumn--default--12\">\n<div class=\"cmp-text     \">\n<div class=\"nested-filtered-table active\">\n<div class=\"container\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n         <input type=\"hidden\" class=\"ExpandLabel\"><br \/>\n         <input type=\"hidden\" class=\"CollapseLabel\"><br \/>\n         <input type=\"hidden\" class=\"BrightcoveAccountID\"> <\/p>\n<div class=\"container text-container\" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<div class=\"row\">\n<div class=\"col-md-12 no-padd \" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<p>None.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"secadvheading aem-GridColumn aem-GridColumn--default--12\">\n<section class=\"section-custom\">\n<div class=\"container\">\n<div class=\"content\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n<p class=\"mt-15\"><b>Additional Documentation<\/b><\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/section><\/div>\n<div class=\"text aem-GridColumn aem-GridColumn--default--12\">\n<div class=\"cmp-text     \">\n<div class=\"nested-filtered-table active\">\n<div class=\"container\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n         <input type=\"hidden\" class=\"ExpandLabel\"><br \/>\n         <input type=\"hidden\" class=\"CollapseLabel\"><br \/>\n         <input type=\"hidden\" class=\"BrightcoveAccountID\"> <\/p>\n<div class=\"container text-container\" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<div class=\"row\">\n<div class=\"col-md-12 no-padd \" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<p>None.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"secadvheading aem-GridColumn aem-GridColumn--default--12\">\n<section class=\"section-custom\">\n<div class=\"container\">\n<div class=\"content\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n<p class=\"mt-15\"><b>Notes<\/b><\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/section><\/div>\n<div class=\"text aem-GridColumn aem-GridColumn--default--12\">\n<div class=\"cmp-text     \">\n<div class=\"nested-filtered-table active\">\n<div class=\"container\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n         <input type=\"hidden\" class=\"ExpandLabel\"><br \/>\n         <input type=\"hidden\" class=\"CollapseLabel\"><br \/>\n         <input type=\"hidden\" class=\"BrightcoveAccountID\"> <\/p>\n<div class=\"container text-container\" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<div class=\"row\">\n<div class=\"col-md-12 no-padd \" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<p>None.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"secadvheading aem-GridColumn aem-GridColumn--default--12\">\n<section class=\"section-custom\">\n<div class=\"container\">\n<div class=\"content\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n<p class=\"mt-15\"><b>Acknowledgements<\/b><\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/section><\/div>\n<div class=\"text aem-GridColumn aem-GridColumn--default--12\">\n<div class=\"cmp-text     \">\n<div class=\"nested-filtered-table active\">\n<div class=\"container\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n         <input type=\"hidden\" class=\"ExpandLabel\"><br \/>\n         <input type=\"hidden\" class=\"CollapseLabel\"><br \/>\n         <input type=\"hidden\" class=\"BrightcoveAccountID\"> <\/p>\n<div class=\"container text-container\" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<div class=\"row\">\n<div class=\"col-md-12 no-padd \" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<p>VMware would like to thank Beist, Chpie, Silenos, and Jz of LINE Security for reporting this issue to us.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"secadvheading aem-GridColumn aem-GridColumn--default--12\">\n<section class=\"section-custom\">\n<div class=\"container\">\n<div class=\"content\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n<p class=\"mt-15\"><b>Response Matrix<\/b><\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/section><\/div>\n<div class=\"advisories-data aem-GridColumn aem-GridColumn--default--12\">\n<section class=\"response-matrix\">\n<div class=\"container\">\n<div class=\"content\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n<div class=\"section-custom\">\n<div class=\"table-responsive\">\n<table class=\"table\">\n<tbody>\n<tr class=\"tr thead\">\n<td class=\"td\">Product<\/td>\n<td class=\"td\">Version<\/td>\n<td class=\"td\">Running On<\/td>\n<td class=\"td\">CVE Identifier<\/td>\n<td class=\"td\">CVSSv3<\/td>\n<td class=\"td\">Severity<\/td>\n<td class=\"td\">Fixed Version<\/td>\n<td class=\"td\">Workarounds<\/td>\n<td class=\"td\">Additional Documentation<\/td>\n<\/tr>\n<tr class=\"tr\">\n<td class=\"td\" data-th=\"Product\">\n<div class=\"td-content\">\n                Fusion\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"Version\">\n<div class=\"td-content\">\n                13.x\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"Running On\">\n<div class=\"td-content\">\n                OS X\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"CVE Identifier\">\n<div class=\"td-content\">\n                CVE-2023-20871\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"CVSSV3\">\n<div class=\"td-content\">\n                <a aria-label=\"7.3\" href=\"https:\/\/www.first.org\/cvss\/calculator\/3.1#CVSS:3.1\/AV:L\/AC:L\/PR:L\/UI:N\/S:U\/C:H\/I:L\/A:H\">7.3<\/a>\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"Severity\">\n<div class=\"td-content\">\n<div class=\"sa-severity-blk\">\n                 important\n                <\/div>\n<p>                <span class=\"sa-severity sa-important\"><\/span>\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"Fixed Version\">\n<div class=\"td-content\">\n                13.0.2\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"Workarounds\">\n<div class=\"td-content\">\n                None\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"Additional Documents\">\n<div class=\"td-content\">\n                None\n               <\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/section><\/div>\n<div class=\"secadvheading aem-GridColumn aem-GridColumn--default--12\">\n<section class=\"section-custom\">\n<div class=\"container\">\n<div class=\"content\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n<h5 id=\"3d-out-of-bounds-read-write-vulnerability-cve-2023-20872\" class=\"mt-30\"><b>3d. Out-of-bounds read\/write vulnerability (CVE-2023-20872)<\/b><\/h5>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/section><\/div>\n<div class=\"secadvheading aem-GridColumn aem-GridColumn--default--12\">\n<section class=\"section-custom\">\n<div class=\"container\">\n<div class=\"content\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n<p class=\"mt-15\"><b>Description<\/b><\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/section><\/div>\n<div class=\"text aem-GridColumn aem-GridColumn--default--12\">\n<div class=\"cmp-text     \">\n<div class=\"nested-filtered-table active\">\n<div class=\"container\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n         <input type=\"hidden\" class=\"ExpandLabel\"><br \/>\n         <input type=\"hidden\" class=\"CollapseLabel\"><br \/>\n         <input type=\"hidden\" class=\"BrightcoveAccountID\"> <\/p>\n<div class=\"container text-container\" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<div class=\"row\">\n<div class=\"col-md-12 no-padd \" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<p>VMware Workstation and Fusion contain an out-of-bounds read\/write vulnerability in SCSI CD\/DVD device emulation. VMware has evaluated the severity of this issue to be in the\u00a0<a href=\"https:\/\/www.vmware.com\/support\/policies\/security_response.html\">Important severity range<\/a>\u00a0with a maximum CVSSv3 base score of\u00a0<a href=\"https:\/\/www.first.org\/cvss\/calculator\/3.1#CVSS:3.1\/AV:L\/AC:H\/PR:N\/UI:R\/S:C\/C:H\/I:H\/A:H\">7.7<\/a>.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"secadvheading aem-GridColumn aem-GridColumn--default--12\">\n<section class=\"section-custom\">\n<div class=\"container\">\n<div class=\"content\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n<p class=\"mt-15\"><b>Known Attack Vectors<\/b><\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/section><\/div>\n<div class=\"text aem-GridColumn aem-GridColumn--default--12\">\n<div class=\"cmp-text     \">\n<div class=\"nested-filtered-table active\">\n<div class=\"container\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n         <input type=\"hidden\" class=\"ExpandLabel\"><br \/>\n         <input type=\"hidden\" class=\"CollapseLabel\"><br \/>\n         <input type=\"hidden\" class=\"BrightcoveAccountID\"> <\/p>\n<div class=\"container text-container\" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<div class=\"row\">\n<div class=\"col-md-12 no-padd \" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<p>A malicious attacker with access to a virtual machine that has\u00a0a physical CD\/DVD drive attached and configured to use a virtual SCSI controller may be able to exploit this vulnerability to execute code on the hypervisor from a virtual machine.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"secadvheading aem-GridColumn aem-GridColumn--default--12\">\n<section class=\"section-custom\">\n<div class=\"container\">\n<div class=\"content\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n<p class=\"mt-15\"><b>Resolution<\/b><\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/section><\/div>\n<div class=\"text aem-GridColumn aem-GridColumn--default--12\">\n<div class=\"cmp-text     \">\n<div class=\"nested-filtered-table active\">\n<div class=\"container\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n         <input type=\"hidden\" class=\"ExpandLabel\"><br \/>\n         <input type=\"hidden\" class=\"CollapseLabel\"><br \/>\n         <input type=\"hidden\" class=\"BrightcoveAccountID\"> <\/p>\n<div class=\"container text-container\" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<div class=\"row\">\n<div class=\"col-md-12 no-padd \" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<p>To remediate CVE-2023-20872 update to the version listed in the &#8216;Fixed Version&#8217; column of the &#8216;Response Matrix&#8217; found below.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"secadvheading aem-GridColumn aem-GridColumn--default--12\">\n<section class=\"section-custom\">\n<div class=\"container\">\n<div class=\"content\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n<p class=\"mt-15\"><b>Workarounds<\/b><\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/section><\/div>\n<div class=\"text aem-GridColumn aem-GridColumn--default--12\">\n<div class=\"cmp-text     \">\n<div class=\"nested-filtered-table active\">\n<div class=\"container\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n         <input type=\"hidden\" class=\"ExpandLabel\"><br \/>\n         <input type=\"hidden\" class=\"CollapseLabel\"><br \/>\n         <input type=\"hidden\" class=\"BrightcoveAccountID\"> <\/p>\n<div class=\"container text-container\" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<div class=\"row\">\n<div class=\"col-md-12 no-padd \" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<p>Workarounds for CVE-2023-20872 have been listed in the &#8216;Workarounds&#8217; column of the &#8216;Response Matrix&#8217; below.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"secadvheading aem-GridColumn aem-GridColumn--default--12\">\n<section class=\"section-custom\">\n<div class=\"container\">\n<div class=\"content\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n<p class=\"mt-15\"><b>Additional Documentation<\/b><\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/section><\/div>\n<div class=\"text aem-GridColumn aem-GridColumn--default--12\">\n<div class=\"cmp-text     \">\n<div class=\"nested-filtered-table active\">\n<div class=\"container\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n         <input type=\"hidden\" class=\"ExpandLabel\"><br \/>\n         <input type=\"hidden\" class=\"CollapseLabel\"><br \/>\n         <input type=\"hidden\" class=\"BrightcoveAccountID\"> <\/p>\n<div class=\"container text-container\" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<div class=\"row\">\n<div class=\"col-md-12 no-padd \" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<p>None.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"secadvheading aem-GridColumn aem-GridColumn--default--12\">\n<section class=\"section-custom\">\n<div class=\"container\">\n<div class=\"content\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n<p class=\"mt-15\"><b>Notes<\/b><\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/section><\/div>\n<div class=\"text aem-GridColumn aem-GridColumn--default--12\">\n<div class=\"cmp-text     \">\n<div class=\"nested-filtered-table active\">\n<div class=\"container\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n         <input type=\"hidden\" class=\"ExpandLabel\"><br \/>\n         <input type=\"hidden\" class=\"CollapseLabel\"><br \/>\n         <input type=\"hidden\" class=\"BrightcoveAccountID\"> <\/p>\n<div class=\"container text-container\" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<div class=\"row\">\n<div class=\"col-md-12 no-padd \" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<p>Successful exploitation of this issue requires\u00a0a physical CD\/DVD drive attached to the virtual machine configured to use a virtual SCSI controller.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"secadvheading aem-GridColumn aem-GridColumn--default--12\">\n<section class=\"section-custom\">\n<div class=\"container\">\n<div class=\"content\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n<p class=\"mt-15\"><b>Acknowledgements<\/b><\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/section><\/div>\n<div class=\"text aem-GridColumn aem-GridColumn--default--12\">\n<div class=\"cmp-text     \">\n<div class=\"nested-filtered-table active\">\n<div class=\"container\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n         <input type=\"hidden\" class=\"ExpandLabel\"><br \/>\n         <input type=\"hidden\" class=\"CollapseLabel\"><br \/>\n         <input type=\"hidden\" class=\"BrightcoveAccountID\"> <\/p>\n<div class=\"container text-container\" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<div class=\"row\">\n<div class=\"col-md-12 no-padd \" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<p>VMware would like to thank\u00a0Wenxu Yin of 360 Vulnerability Research Institute\u00a0for reporting this issue to us.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"secadvheading aem-GridColumn aem-GridColumn--default--12\">\n<section class=\"section-custom\">\n<div class=\"container\">\n<div class=\"content\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n<p class=\"mt-15\"><b>Response Matrix<\/b><\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/section><\/div>\n<div class=\"advisories-data aem-GridColumn aem-GridColumn--default--12\">\n<section class=\"response-matrix\">\n<div class=\"container\">\n<div class=\"content\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n<div class=\"section-custom\">\n<div class=\"table-responsive\">\n<table class=\"table\">\n<tbody>\n<tr class=\"tr thead\">\n<td class=\"td\">Product<\/td>\n<td class=\"td\">Version<\/td>\n<td class=\"td\">Running On<\/td>\n<td class=\"td\">CVE Identifier<\/td>\n<td class=\"td\">CVSSv3<\/td>\n<td class=\"td\">Severity<\/td>\n<td class=\"td\">Fixed Version<\/td>\n<td class=\"td\">Workarounds<\/td>\n<td class=\"td\">Additional Documentation<\/td>\n<\/tr>\n<tr class=\"tr\">\n<td class=\"td\" data-th=\"Product\">\n<div class=\"td-content\">\n                Workstation\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"Version\">\n<div class=\"td-content\">\n                17.x\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"Running On\">\n<div class=\"td-content\">\n                Any\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"CVE Identifier\">\n<div class=\"td-content\">\n                CVE-2023-20872\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"CVSSV3\">\n<div class=\"td-content\">\n                <a aria-label=\"7.7\" href=\"https:\/\/www.first.org\/cvss\/calculator\/3.1#CVSS:3.1\/AV:L\/AC:H\/PR:N\/UI:R\/S:C\/C:H\/I:H\/A:H\">7.7<\/a>\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"Severity\">\n<div class=\"td-content\">\n<div class=\"sa-severity-blk\">\n                 important\n                <\/div>\n<p>                <span class=\"sa-severity sa-important\"><\/span>\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"Fixed Version\">\n<div class=\"td-content\">\n                17.0.1\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"Workarounds\">\n<div class=\"td-content\">\n                <a aria-label=\"KB91949\" href=\"https:\/\/kb.vmware.com\/s\/article\/91949\">KB91949<\/a>\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"Additional Documents\">\n<div class=\"td-content\">\n                None\n               <\/div>\n<\/td>\n<\/tr>\n<tr class=\"tr\">\n<td class=\"td\" data-th=\"Product\">\n<div class=\"td-content\">\n                Fusion\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"Version\">\n<div class=\"td-content\">\n                13.x\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"Running On\">\n<div class=\"td-content\">\n                OS X\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"CVE Identifier\">\n<div class=\"td-content\">\n                CVE-2023-20872\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"CVSSV3\">\n<div class=\"td-content\">\n                <a aria-label=\"7.7\" href=\"https:\/\/www.first.org\/cvss\/calculator\/3.1#CVSS:3.1\/AV:L\/AC:H\/PR:N\/UI:R\/S:C\/C:H\/I:H\/A:H\">7.7<\/a>\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"Severity\">\n<div class=\"td-content\">\n<div class=\"sa-severity-blk\">\n                 important\n                <\/div>\n<p>                <span class=\"sa-severity sa-important\"><\/span>\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"Fixed Version\">\n<div class=\"td-content\">\n                13.0.1\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"Workarounds\">\n<div class=\"td-content\">\n                <a aria-label=\"KB91949\" href=\"https:\/\/kb.vmware.com\/s\/article\/91949\">KB91949<\/a>\n               <\/div>\n<\/td>\n<td class=\"td\" data-th=\"Additional Documents\">\n<div class=\"td-content\">\n                None\n               <\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/section><\/div>\n<div class=\"secadvheading aem-GridColumn aem-GridColumn--default--12\">\n<section class=\"section-custom\">\n<div class=\"container\">\n<div class=\"content\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n<h5 id=\"4-references\" class=\"mt-30\"><b>4. References<\/b><\/h5>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/section><\/div>\n<div class=\"text aem-GridColumn aem-GridColumn--default--12\">\n<div class=\"cmp-text     \">\n<div class=\"nested-filtered-table active\">\n<div class=\"container\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n         <input type=\"hidden\" class=\"ExpandLabel\"><br \/>\n         <input type=\"hidden\" class=\"CollapseLabel\"><br \/>\n         <input type=\"hidden\" class=\"BrightcoveAccountID\"> <\/p>\n<div class=\"container text-container\" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<div class=\"row\">\n<div class=\"col-md-12 no-padd \" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<p><b>Fixed Version(s) and Release Notes:<\/b><\/p>\n<p><b>VMware Fusion 13.0.2:<\/b><br \/> Downloads and Documentation:<br \/> <a href=\"https:\/\/customerconnect.vmware.com\/downloads\/info\/slug\/desktop_end_user_computing\/vmware_fusion\/13_0\">https:\/\/customerconnect.vmware.com\/downloads\/info\/slug\/desktop_end_user_computing\/vmware_fusion\/13_0<\/a><br \/> <a href=\"https:\/\/docs.vmware.com\/en\/VMware-Fusion\/13.0.2\/rn\/vmware-fusion-1302-release-notes\/index.html\">https:\/\/docs.vmware.com\/en\/VMware-Fusion\/13.0.2\/rn\/vmware-fusion-1302-release-notes\/index.html<\/a><\/p>\n<p><b>VMware Workstation 17.0.2:<\/b><br \/> Downloads and Documentation:<br \/> <a href=\"https:\/\/customerconnect.vmware.com\/downloads\/info\/slug\/desktop_end_user_computing\/vmware_workstation_pro\/17_0\">https:\/\/customerconnect.vmware.com\/downloads\/info\/slug\/desktop_end_user_computing\/vmware_workstation_pro\/17_0<\/a><br \/> <a href=\"https:\/\/docs.vmware.com\/en\/VMware-Workstation-Pro\/17.0.2\/rn\/vmware-workstation-1702-pro-release-notes\/index.html\">https:\/\/docs.vmware.com\/en\/VMware-Workstation-Pro\/17.0.2\/rn\/vmware-workstation-1702-pro-release-notes\/index.html<\/a><\/p>\n<p><b>Mitre CVE Dictionary Links:<\/b><br \/> <a href=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2023-20869\">https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2023-20869<\/a><br \/> <a href=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2023-20870\">https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2023-20870<\/a>\u00a0<br \/> <a href=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2023-20871\">https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2023-20871<\/a><br \/> <a href=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2023-20872\">https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2023-20872<\/a><\/p>\n<p><b>FIRST CVSSv3 Calculator:<\/b><br \/> CVE-2023-20869:<b>\u00a0<\/b><a href=\"https:\/\/www.first.org\/cvss\/calculator\/3.1#CVSS:3.1\/AV:L\/AC:L\/PR:N\/UI:N\/S:C\/C:H\/I:H\/A:H\">https:\/\/www.first.org\/cvss\/calculator\/3.1#CVSS:3.1\/AV:L\/AC:L\/PR:N\/UI:N\/S:C\/C:H\/I:H\/A:H<\/a><br \/> CVE-2023-20870:<b>\u00a0<\/b><a href=\"https:\/\/www.first.org\/cvss\/calculator\/3.1#CVSS:3.1\/AV:L\/AC:L\/PR:N\/UI:N\/S:C\/C:H\/I:N\/A:N\">https:\/\/www.first.org\/cvss\/calculator\/3.1#CVSS:3.1\/AV:L\/AC:L\/PR:N\/UI:N\/S:C\/C:H\/I:N\/A:N<\/a><br \/> CVE-2023-20871:\u00a0<a href=\"https:\/\/www.first.org\/cvss\/calculator\/3.1#CVSS:3.1\/AV:L\/AC:L\/PR:L\/UI:N\/S:U\/C:H\/I:L\/A:H\">https:\/\/www.first.org\/cvss\/calculator\/3.1#CVSS:3.1\/AV:L\/AC:L\/PR:L\/UI:N\/S:U\/C:H\/I:L\/A:H<\/a><b><br \/> <\/b>CVE-2023-20872:<b>\u00a0<\/b><a href=\"https:\/\/www.first.org\/cvss\/calculator\/3.1#CVSS:3.1\/AV:L\/AC:H\/PR:N\/UI:R\/S:C\/C:H\/I:H\/A:H\">https:\/\/www.first.org\/cvss\/calculator\/3.1#CVSS:3.1\/AV:L\/AC:H\/PR:N\/UI:R\/S:C\/C:H\/I:H\/A:H<\/a> <\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"secadvheading aem-GridColumn aem-GridColumn--default--12\">\n<section class=\"section-custom\">\n<div class=\"container\">\n<div class=\"content\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n<h5 id=\"5-change-log\" class=\"mt-30\"><b>5. Change Log<\/b><\/h5>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/section><\/div>\n<div class=\"text aem-GridColumn aem-GridColumn--default--12\">\n<div class=\"cmp-text     \">\n<div class=\"nested-filtered-table active\">\n<div class=\"container\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n         <input type=\"hidden\" class=\"ExpandLabel\"><br \/>\n         <input type=\"hidden\" class=\"CollapseLabel\"><br \/>\n         <input type=\"hidden\" class=\"BrightcoveAccountID\"> <\/p>\n<div class=\"container text-container\" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<div class=\"row\">\n<div class=\"col-md-12 no-padd \" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<p><b>2023-04-25 VMSA-2023-0008<br \/> <\/b>Initial security advisory.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"secadvheading aem-GridColumn aem-GridColumn--default--12\">\n<section class=\"section-custom\">\n<div class=\"container\">\n<div class=\"content\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n<h5 id=\"6-contact\" class=\"mt-30\"><b>6. Contact<\/b><\/h5>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/section><\/div>\n<div class=\"text aem-GridColumn aem-GridColumn--default--12\">\n<div class=\"cmp-text     \">\n<div class=\"nested-filtered-table active\">\n<div class=\"container\">\n<div class=\"row\">\n<div class=\"col-md-12\">\n         <input type=\"hidden\" class=\"ExpandLabel\"><br \/>\n         <input type=\"hidden\" class=\"CollapseLabel\"><br \/>\n         <input type=\"hidden\" class=\"BrightcoveAccountID\"> <\/p>\n<div class=\"container text-container\" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<div class=\"row\">\n<div class=\"col-md-12 no-padd \" data-aos=\"fade-up\" data-aos-delay=\"500\">\n<p>E-mail: <a href=\"mailto:security@vmware.com\">security@vmware.com<\/a><\/p>\n<p>PGP key at:<br \/> <a href=\"https:\/\/kb.vmware.com\/kb\/1055\">https:\/\/kb.vmware.com\/kb\/1055\u00a0<\/a><\/p>\n<p>VMware Security Advisories<br \/> <a href=\"https:\/\/www.vmware.com\/security\/advisories\">https:\/\/www.vmware.com\/security\/advisories\u00a0<\/a><\/p>\n<p>VMware Security Response Policy<br \/> <a href=\"https:\/\/www.vmware.com\/support\/policies\/security_response.html\">https:\/\/www.vmware.com\/support\/policies\/security_response.html\u00a0<\/a><\/p>\n<p>VMware Lifecycle Support Phases<br \/> <a href=\"https:\/\/www.vmware.com\/support\/policies\/lifecycle.html\">https:\/\/www.vmware.com\/support\/policies\/lifecycle.html\u00a0<\/a><\/p>\n<p>VMware Security &amp; Compliance Blog\u00a0\u00a0<br \/> <a href=\"https:\/\/blogs.vmware.com\/security\">https:\/\/blogs.vmware.com\/security\u00a0<\/a><\/p>\n<p>Twitter<br \/> <a href=\"https:\/\/twitter.com\/VMwareSRC\">https:\/\/twitter.com\/VMwareSRC<br \/> <\/a><\/p>\n<p>Copyright 2023 VMware Inc. All rights reserved.<br \/> \u00a0 <\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/div>\n<\/div>\n<p><a href=\"https:\/\/www.vmware.com\/security\/advisories\/VMSA-2023-0008.html\">Read full article (vmware.com)<\/a><\/p>\n<p>All content and images belong to their respected owners, this article is curated for informational purposes only.<\/p>\n","protected":false},"excerpt":{"rendered":"Critical Advisory ID: VMSA-2023-0008 CVSSv3 Range: 7.3-9.3 Issue Date: 2023-04-25 Updated On: 2023-04-25 (Initial Advisory) CVE(s): CVE-2023-20869, CVE-2023-20870,&hellip;\n","protected":false},"author":2,"featured_media":2586,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"csco_singular_sidebar":"","csco_page_header_type":"","csco_appearance_grid":"","csco_page_load_nextpost":"","csco_post_video_location":[],"csco_post_video_location_hash":"","csco_post_video_url":"","csco_post_video_bg_start_time":0,"csco_post_video_bg_end_time":0,"footnotes":""},"categories":[16],"tags":[390,393,1710],"coauthors":[48],"class_list":["post-4244","post","type-post","status-publish","format-standard","has-post-thumbnail","category-vmware-virtualisation","tag-advisory","tag-critical","tag-vmsa20230008","cs-entry","cs-video-wrap"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.5 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>VMSA-2023-0008 | Sebae Networks<\/title>\n<meta name=\"description\" content=\"View VMSA-2023-0008 for free, here at Sebae. Discover more great posts on our website.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.sebae.net\/blog\/vmsa-2023-0008\/\" \/>\n<meta property=\"og:locale\" content=\"en_GB\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"VMSA-2023-0008 | Sebae Networks\" \/>\n<meta property=\"og:description\" content=\"View VMSA-2023-0008 for free, here at Sebae. Discover more great posts on our website.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.sebae.net\/blog\/vmsa-2023-0008\/\" \/>\n<meta property=\"og:site_name\" content=\"Sebae Networks\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/sebaenetworks\" \/>\n<meta property=\"article:published_time\" content=\"2023-04-27T01:00:18+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.sebae.net\/blog\/wp-content\/uploads\/2023\/12\/sebae-logo-card.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"675\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"James Dean\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@sebaenetworks\" \/>\n<meta name=\"twitter:site\" content=\"@sebaenetworks\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"James Dean\" \/>\n\t<meta name=\"twitter:label2\" content=\"Estimated reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"VMSA-2023-0008 | Sebae Networks","description":"View VMSA-2023-0008 for free, here at Sebae. Discover more great posts on our website.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.sebae.net\/blog\/vmsa-2023-0008\/","og_locale":"en_GB","og_type":"article","og_title":"VMSA-2023-0008 | Sebae Networks","og_description":"View VMSA-2023-0008 for free, here at Sebae. Discover more great posts on our website.","og_url":"https:\/\/www.sebae.net\/blog\/vmsa-2023-0008\/","og_site_name":"Sebae Networks","article_publisher":"https:\/\/www.facebook.com\/sebaenetworks","article_published_time":"2023-04-27T01:00:18+00:00","og_image":[{"width":1200,"height":675,"url":"https:\/\/www.sebae.net\/blog\/wp-content\/uploads\/2023\/12\/sebae-logo-card.jpg","type":"image\/jpeg"}],"author":"James Dean","twitter_card":"summary_large_image","twitter_creator":"@sebaenetworks","twitter_site":"@sebaenetworks","twitter_misc":{"Written by":"James Dean","Estimated reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.sebae.net\/blog\/vmsa-2023-0008\/#article","isPartOf":{"@id":"https:\/\/www.sebae.net\/blog\/vmsa-2023-0008\/"},"author":{"name":"James Dean","@id":"https:\/\/www.sebae.net\/blog\/#\/schema\/person\/6d07e05e3d3e4483117c4e2c3315a89f"},"headline":"VMSA-2023-0008","datePublished":"2023-04-27T01:00:18+00:00","mainEntityOfPage":{"@id":"https:\/\/www.sebae.net\/blog\/vmsa-2023-0008\/"},"wordCount":1109,"commentCount":0,"publisher":{"@id":"https:\/\/www.sebae.net\/blog\/#organization"},"image":{"@id":"https:\/\/www.sebae.net\/blog\/vmsa-2023-0008\/#primaryimage"},"thumbnailUrl":"https:\/\/www.sebae.net\/blog\/wp-content\/uploads\/2021\/11\/vmware-logo-header.png","keywords":["Advisory","Critical","VMSA20230008"],"articleSection":["VMware Virtualisation"],"inLanguage":"en-GB","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.sebae.net\/blog\/vmsa-2023-0008\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.sebae.net\/blog\/vmsa-2023-0008\/","url":"https:\/\/www.sebae.net\/blog\/vmsa-2023-0008\/","name":"VMSA-2023-0008 | Sebae Networks","isPartOf":{"@id":"https:\/\/www.sebae.net\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.sebae.net\/blog\/vmsa-2023-0008\/#primaryimage"},"image":{"@id":"https:\/\/www.sebae.net\/blog\/vmsa-2023-0008\/#primaryimage"},"thumbnailUrl":"https:\/\/www.sebae.net\/blog\/wp-content\/uploads\/2021\/11\/vmware-logo-header.png","datePublished":"2023-04-27T01:00:18+00:00","description":"View VMSA-2023-0008 for free, here at Sebae. Discover more great posts on our website.","breadcrumb":{"@id":"https:\/\/www.sebae.net\/blog\/vmsa-2023-0008\/#breadcrumb"},"inLanguage":"en-GB","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.sebae.net\/blog\/vmsa-2023-0008\/"]}]},{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/www.sebae.net\/blog\/vmsa-2023-0008\/#primaryimage","url":"https:\/\/www.sebae.net\/blog\/wp-content\/uploads\/2021\/11\/vmware-logo-header.png","contentUrl":"https:\/\/www.sebae.net\/blog\/wp-content\/uploads\/2021\/11\/vmware-logo-header.png","width":1920,"height":1080,"caption":"vmware logo header"},{"@type":"BreadcrumbList","@id":"https:\/\/www.sebae.net\/blog\/vmsa-2023-0008\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.sebae.net\/blog\/"},{"@type":"ListItem","position":2,"name":"VMSA-2023-0008"}]},{"@type":"WebSite","@id":"https:\/\/www.sebae.net\/blog\/#website","url":"https:\/\/www.sebae.net\/blog\/","name":"Sebae Networks","description":"Tech Tips, News, Tutorials &amp; Advice","publisher":{"@id":"https:\/\/www.sebae.net\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.sebae.net\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-GB"},{"@type":"Organization","@id":"https:\/\/www.sebae.net\/blog\/#organization","name":"Sebae","url":"https:\/\/www.sebae.net\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/www.sebae.net\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.sebae.net\/blog\/wp-content\/uploads\/2023\/06\/sebae-logo-icon.png","contentUrl":"https:\/\/www.sebae.net\/blog\/wp-content\/uploads\/2023\/06\/sebae-logo-icon.png","width":512,"height":512,"caption":"Sebae"},"image":{"@id":"https:\/\/www.sebae.net\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/sebaenetworks","https:\/\/x.com\/sebaenetworks"]},{"@type":"Person","@id":"https:\/\/www.sebae.net\/blog\/#\/schema\/person\/6d07e05e3d3e4483117c4e2c3315a89f","name":"James Dean","image":{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/www.sebae.net\/blog\/wp-content\/uploads\/2021\/10\/avatar_user_2_1634496168-96x96.jpg72371c27260698ee55141397050ef40a","url":"https:\/\/www.sebae.net\/blog\/wp-content\/uploads\/2021\/10\/avatar_user_2_1634496168-96x96.jpg","contentUrl":"https:\/\/www.sebae.net\/blog\/wp-content\/uploads\/2021\/10\/avatar_user_2_1634496168-96x96.jpg","caption":"James Dean"},"sameAs":["https:\/\/www.sebae.net"],"url":"https:\/\/www.sebae.net\/blog\/author\/jdean\/"}]}},"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/www.sebae.net\/blog\/wp-json\/wp\/v2\/posts\/4244","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.sebae.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.sebae.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.sebae.net\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.sebae.net\/blog\/wp-json\/wp\/v2\/comments?post=4244"}],"version-history":[{"count":0,"href":"https:\/\/www.sebae.net\/blog\/wp-json\/wp\/v2\/posts\/4244\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.sebae.net\/blog\/wp-json\/wp\/v2\/media\/2586"}],"wp:attachment":[{"href":"https:\/\/www.sebae.net\/blog\/wp-json\/wp\/v2\/media?parent=4244"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.sebae.net\/blog\/wp-json\/wp\/v2\/categories?post=4244"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.sebae.net\/blog\/wp-json\/wp\/v2\/tags?post=4244"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.sebae.net\/blog\/wp-json\/wp\/v2\/coauthors?post=4244"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}