VMware Horizon Client vulnerabilities

25 CVEs affecting VMware Horizon Client, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-34038, published 2023-08-04.

More from VMware.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2020-3950: VMware Multiple Products Privilege Escalation Vulnerability, published 2020-03-17. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 7.3% chance of exploitation in the next 30 days. VMware Fusion (11.x before 11.5.2), VMware Remote Console for Mac (11.x and prior before 11.0.1) and Horizon Client for Mac (5.x and prior before 5.4.0) contain a privilege escalation vulnerability…
• CVE-2018-6970, published 2018-08-13. Medium severity, CVSS 6.5. EPSS: 1.8% chance of exploitation in the next 30 days. VMware Horizon 6 (6.x.x before 6.2.7), Horizon 7 (7.x.x before 7.5.1), and Horizon Client (4.x.x and prior before 4.8.1) contain an out-of-bounds read vulnerability in the Message Framework library.…
• CVE-2020-3998, published 2020-10-23. Medium severity, CVSS 6.5. EPSS: 1.3% chance of exploitation in the next 30 days. VMware Horizon Client for Windows (5.x prior to 5.5.0) contains an information disclosure vulnerability. A malicious attacker with local privileges on the machine where Horizon Client for Windows is…
• CVE-2015-2337, published 2015-06-13. Medium severity, CVSS 5.8. EPSS: 0.7% chance of exploitation in the next 30 days. TPInt.dll in VMware Workstation 10.x before 10.0.6 and 11.x before 11.1.1, VMware Player 6.x before 6.0.6 and 7.x before 7.1.1, and VMware Horizon Client 3.2.x before 3.2.1, 3.3.x, and 5.x local-mode…
• CVE-2015-2336, published 2015-06-13. Medium severity, CVSS 5.8. EPSS: 0.7% chance of exploitation in the next 30 days. TPView.dll in VMware Workstation 10.x before 10.0.6 and 11.x before 11.1.1, VMware Player 6.x before 6.0.6 and 7.x before 7.1.1, and VMware Horizon Client 3.2.x before 3.2.1, 3.3.x, and 5.x…
• CVE-2015-2340, published 2015-06-13. Medium severity, CVSS 6.1. EPSS: 0.7% chance of exploitation in the next 30 days. TPInt.dll in VMware Workstation 10.x before 10.0.6 and 11.x before 11.1.1, VMware Player 6.x before 6.0.6 and 7.x before 7.1.1, and VMware Horizon Client 3.2.x before 3.2.1, 3.3.x, and 5.x local-mode…
• CVE-2015-2339, published 2015-06-13. Medium severity, CVSS 6.1. EPSS: 0.7% chance of exploitation in the next 30 days. TPview.dll in VMware Workstation 10.x before 10.0.6 and 11.x before 11.1.1, VMware Player 6.x before 6.0.6 and 7.x before 7.1.1, and VMware Horizon Client 3.2.x before 3.2.1, 3.3.x, and 5.x…
• CVE-2015-2338, published 2015-06-13. Medium severity, CVSS 6.1. EPSS: 0.7% chance of exploitation in the next 30 days. TPview.dll in VMware Workstation 10.x before 10.0.6 and 11.x before 11.1.1, VMware Player 6.x before 6.0.6 and 7.x before 7.1.1, and VMware Horizon Client 3.2.x before 3.2.1, 3.3.x, and 5.x…
• CVE-2021-21987, published 2021-05-24. Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days. VMware Workstation (16.x prior to 16.1.2) and Horizon Client for Windows (5.x prior to 5.5.2) contain out-of-bounds read vulnerability in the Cortado ThinPrint component (TTC Parser). A malicious…
• CVE-2023-34038, published 2023-08-04. Medium severity, CVSS 5.3. EPSS: 0.5% chance of exploitation in the next 30 days. VMware Horizon Server contains an information disclosure vulnerability. A malicious actor with network access may be able to access information relating to the internal network configuration.

Latest

• CVE-2023-34037, published 2023-08-04. Medium severity, CVSS 5.3. EPSS: 0.5% chance of exploitation in the next 30 days. VMware Horizon Server contains a HTTP request smuggling vulnerability. A malicious actor with network access may be able to perform HTTP smuggle requests.
• CVE-2021-21989, published 2021-05-24. Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days. VMware Workstation (16.x prior to 16.1.2) and Horizon Client for Windows (5.x prior to 5.5.2) contain out-of-bounds read vulnerability in the Cortado ThinPrint component (TTC Parser). A malicious…
• CVE-2021-21988, published 2021-05-24. Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days. VMware Workstation (16.x prior to 16.1.2) and Horizon Client for Windows (5.x prior to 5.5.2) contain out-of-bounds read vulnerability in the Cortado ThinPrint component (JPEG2000 Parser). A…
• CVE-2020-3991, published 2020-10-16. High severity, CVSS 7.1. EPSS: 0.3% chance of exploitation in the next 30 days. VMware Horizon Client for Windows (5.x before 5.5.0) contains a denial-of-service vulnerability due to a file system access control issue during install time. Successful exploitation of this issue…
• CVE-2020-3990, published 2020-09-16. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. VMware Workstation (15.x) and Horizon Client for Windows (5.x before 5.4.4) contain an information disclosure vulnerability due to an integer overflow issue in Cortado ThinPrint component. A…
• CVE-2020-3989, published 2020-09-16. Low severity, CVSS 3.3. EPSS: 0.3% chance of exploitation in the next 30 days. VMware Workstation (15.x) and Horizon Client for Windows (5.x before 5.4.4) contain a denial of service vulnerability due to an out-of-bounds write issue in Cortado ThinPrint component. A malicious…
• CVE-2020-3988, published 2020-09-16. Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days. VMware Workstation (15.x) and Horizon Client for Windows (5.x before 5.4.4) contain an out-of-bounds read vulnerability in Cortado ThinPrint component (JPEG2000 parser). A malicious actor with normal…