OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade openslpUpgrade openslp-debuginfoUpgrade openslp-develUpgrade openslp-server | Apr 27, 2020 | Dec 6, 2019 |
| Centos_linux | — | Upgrade openslp-debuginfoUpgrade openslpUpgrade openslp-serverUpgrade openslp-devel | Dec 17, 2019 | Dec 6, 2019 |
| Debian | — | Upgrade openslp-dfsg | Dec 11, 2019 | Dec 6, 2019 |
| Gentoo Linux | — | Upgrade net-misc/openslp. | Jun 15, 2020 | Dec 6, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade openslp-serverUpgrade openslp | Jun 17, 2020 | Dec 6, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade openslp-serverUpgrade openslp | Apr 16, 2020 | Dec 6, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade openslp-serverUpgrade openslp | Feb 24, 2020 | Dec 6, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade openslpUpgrade openslp-server | Jan 3, 2020 | Dec 6, 2019 |
| Oracle_linux | — | Upgrade openslp-serverUpgrade openslp-develUpgrade openslp | Jan 24, 2020 | Dec 6, 2019 |
| Redhat_linux | — | Upgrade openslpUpgrade openslp-debuginfoUpgrade openslp-serverUpgrade openslp-devel | Dec 17, 2019 | Dec 6, 2019 |
| Suse | — | Upgrade openslpUpgrade openslp-32bitUpgrade openslp-server | Aug 17, 2021 | Dec 6, 2019 |
| Ubuntu | — | Upgrade libslp1Upgrade libslp1 (Ubuntu Pro) | Apr 20, 2021 | Dec 6, 2019 |
| Vmsa 2019 0022 | — | Upgrade VMware ESXi 6.5 to build number 15177306Upgrade VMware ESXi 6.7 to build number 15160138Upgrade VMware ESXi 6.0 to build number 15169789 | Dec 9, 2019 | Dec 5, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub