OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade openslp-debuginfoUpgrade openslp-serverUpgrade openslp-develUpgrade openslp | Apr 27, 2020 | Dec 6, 2019 |
| Centos_linux | — | Upgrade openslp-debuginfoUpgrade openslp-serverUpgrade openslpUpgrade openslp-devel | Dec 17, 2019 | Dec 6, 2019 |
| Debian | — | Upgrade openslp-dfsg | Dec 11, 2019 | Dec 6, 2019 |
| Gentoo Linux | — | Upgrade net-misc/openslp. | Jun 15, 2020 | Dec 6, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade openslpUpgrade openslp-server | Jun 17, 2020 | Dec 6, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade openslpUpgrade openslp-server | Apr 16, 2020 | Dec 6, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade openslpUpgrade openslp-server | Feb 24, 2020 | Dec 6, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade openslp-serverUpgrade openslp | Jan 3, 2020 | Dec 6, 2019 |
| Oracle_linux | — | Upgrade openslpUpgrade openslp-serverUpgrade openslp-devel | Jan 24, 2020 | Dec 6, 2019 |
| Redhat_linux | — | Upgrade openslpUpgrade openslp-serverUpgrade openslp-develUpgrade openslp-debuginfo | Dec 17, 2019 | Dec 6, 2019 |
| Suse | — | Upgrade openslpUpgrade openslp-32bitUpgrade openslp-server | Aug 17, 2021 | Dec 6, 2019 |
| Ubuntu | — | Upgrade libslp1 (Ubuntu Pro)Upgrade libslp1 | Apr 20, 2021 | Dec 6, 2019 |
| Vmsa 2019 0022 | — | Upgrade VMware ESXi 6.5 to build number 15177306Upgrade VMware ESXi 6.7 to build number 15160138Upgrade VMware ESXi 6.0 to build number 15169789 | Dec 9, 2019 | Dec 5, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub