Integer overflow in VMware Horizon Client and VMware Workstation - CVE-2020-3990
Published: September 16, 2020
Vulnerability identifier: #VU46757
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-3990
CWE-ID: CWE-190
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain access to sensitive information on the system.
The vulnerability exists due to integer overflow in Cortado ThinPrint component. A remote authenticated attacker can pass specially crafted data to the application, trigger integer overflow and gain access to sensitive information on the target system.
Affected software
VMware Horizon Client
VMware Workstation
VMware Workstation
How to mitigate CVE-2020-3990
Install updates from vendor's website.
VMware Horizon Client - update to 5.4.4