Anhdaden

**Name of the Vulnerable Software and Affected Versions** VMware ESXi versions 7.0 before ESXi 7.0.0-1.20.16321839 VMware ESXi versions 6.7 before ESXi670-202004101-SG VMware ESXi versions 6.5 before ESXi650-202005401-SG VMware Workstation versions 15.x before 15.5.5 VMware Fusion versions 11.x before 11.5.5 **Description** The issue is related to an out-of-bounds read vulnerability in the Shader functionality. A malicious actor with non-administrative local access to a virtual machine with 3D graphics enabled may be able to exploit this vulnerability to crash the virtual machine's vmx process, leading to a partial denial of service condition. **Recommendations** For VMware ESXi versions 7.0 before ESXi 7.0.0-1.20.16321839, update to ESXi 7.0.0-1.20.16321839 or later. For VMware ESXi versions 6.7 before ESXi670-202004101-SG, update to ESXi670-202004101-SG or later. For VMware ESXi versions 6.5 before ESXi650-202005401-SG, update to ESXi650-202005401-SG or later. For VMware Workstation versions 15.x before 15.5.5, update to 15.5.5 or later. For VMware Fusion versions 11.x before 11.5.5, update to 11.5.5 or later.

**Name of the Vulnerable Software and Affected Versions** Oracle VM VirtualBox versions prior to 5.2.40 Oracle VM VirtualBox versions prior to 6.0.20 Oracle VM VirtualBox versions prior to 6.1.6 **Description** The issue is related to insecure privilege management in the Core component of Oracle VM VirtualBox. It allows a high-privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks can result in the takeover of Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. **Recommendations** For versions prior to 5.2.40, update to version 5.2.40 or later. For versions prior to 6.0.20, update to version 6.0.20 or later. For versions prior to 6.1.6, update to version 6.1.6 or later.

**Name of the Vulnerable Software and Affected Versions** Oracle VM VirtualBox versions prior to 5.2.40 Oracle VM VirtualBox versions prior to 6.0.20 Oracle VM VirtualBox versions prior to 6.1.6 **Description** The issue is related to insufficient access control in the Core component of Oracle VM VirtualBox, allowing a high-privileged attacker with logon access to the infrastructure to compromise Oracle VM VirtualBox. Successful attacks can result in the takeover of Oracle VM VirtualBox and may significantly impact additional products. **Recommendations** For versions prior to 5.2.40, update to version 5.2.40 or later. For versions prior to 6.0.20, update to version 6.0.20 or later. For versions prior to 6.1.6, update to version 6.1.6 or later.

**Name of the Vulnerable Software and Affected Versions** Oracle VM VirtualBox versions prior to 5.2.40 Oracle VM VirtualBox versions prior to 6.0.20 Oracle VM VirtualBox versions prior to 6.1.6 **Description** The issue is related to insufficient input validation in the Core component of Oracle VM VirtualBox, specifically in the e1000 virtual network interface. This allows a high-privileged attacker with logon access to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks can result in the takeover of Oracle VM VirtualBox. The vulnerability may also impact additional products. **Recommendations** For versions prior to 5.2.40, update to version 5.2.40 or later. For versions prior to 6.0.20, update to version 6.0.20 or later. For versions prior to 6.1.6, update to version 6.1.6 or later.

**Name of the Vulnerable Software and Affected Versions** Oracle VM VirtualBox versions prior to 5.2.40 Oracle VM VirtualBox versions prior to 6.0.20 Oracle VM VirtualBox versions prior to 6.1.6 **Description** The issue is related to the Oracle VM VirtualBox product, specifically the Core component. It allows a high-privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox, potentially resulting in unauthorized read access to a subset of Oracle VM VirtualBox accessible data. The vulnerability may significantly impact additional products. The `vmsvgaR3FifoUpdateCursor` function of the virtual machine is associated with a lack of protection of service data, which can be exploited to gain unauthorized access to protected information. **Recommendations** For versions prior to 5.2.40, update to version 5.2.40 or later. For versions prior to 6.0.20, update to version 6.0.20 or later. For versions prior to 6.1.6, update to version 6.1.6 or later. As a temporary workaround, consider restricting access to the `vmsvgaR3FifoUpdateCursor` function until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Oracle VM VirtualBox versions prior to 5.2.36 Oracle VM VirtualBox versions prior to 6.0.16 Oracle VM VirtualBox versions prior to 6.1.2 **Description** The issue is related to a lack of protection for internal data in the Core component of Oracle VM VirtualBox. This can be exploited by an attacker to impact the confidentiality, integrity, and availability of protected information. The vulnerability can be easily exploited by a high-privileged attacker with logon access to the infrastructure where Oracle VM VirtualBox is executed, potentially leading to a takeover of Oracle VM VirtualBox. **Recommendations** For versions prior to 5.2.36, update to version 5.2.36 or later. For versions prior to 6.0.16, update to version 6.0.16 or later. For versions prior to 6.1.2, update to version 6.1.2 or later.

**Name of the Vulnerable Software and Affected Versions** Oracle VM VirtualBox versions prior to 5.2.40 Oracle VM VirtualBox versions prior to 6.0.20 Oracle VM VirtualBox versions prior to 6.1.6 **Description** The issue is related to insufficient input validation in the D3D9 virtual machine objects of Oracle VM VirtualBox, allowing a low-privileged attacker with logon to the infrastructure to compromise Oracle VM VirtualBox. Successful attacks can result in the takeover of Oracle VM VirtualBox and may significantly impact additional products. **Recommendations** For versions prior to 5.2.40, update to version 5.2.40 or later. For versions prior to 6.0.20, update to version 6.0.20 or later. For versions prior to 6.1.6, update to version 6.1.6 or later.

**Name of the Vulnerable Software and Affected Versions** Oracle VM VirtualBox versions prior to 5.2.34 and prior to 6.0.14 **Description** The issue is related to insufficient access control in the Core component of Oracle VM VirtualBox, allowing an attacker to gain unauthorized access to protected information. This vulnerability can be easily exploited by a low-privileged attacker with logon access to the infrastructure where Oracle VM VirtualBox is executed, potentially compromising Oracle VM VirtualBox and impacting additional products. Successful attacks may result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. **Recommendations** For versions prior to 5.2.34, update to version 5.2.34 or later. For versions prior to 6.0.14, update to version 6.0.14 or later.

**Name of the Vulnerable Software and Affected Versions** Oracle VM VirtualBox versions prior to 5.2.34 Oracle VM VirtualBox versions prior to 6.0.14 **Description** A vulnerability in the Oracle VM VirtualBox product allows a highly privileged attacker with logon to the infrastructure where Oracle VM VirtualBox is executed to compromise it. The vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. Although the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. **Recommendations** For versions prior to 5.2.34, update to version 5.2.34 or later. For versions prior to 6.0.14, update to version 6.0.14 or later. As a temporary workaround, consider restricting access to the Core component of Oracle VM VirtualBox to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Oracle VM VirtualBox versions prior to 5.2.28 Oracle VM VirtualBox versions prior to 6.0.6 **Description** The issue allows a low-privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks can result in the takeover of Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. **Recommendations** For versions prior to 5.2.28, update to version 5.2.28 or later. For versions prior to 6.0.6, update to version 6.0.6 or later.