1. Impacted Products
- VMware Horizon Client for Windows
A denial-of-service vulnerability affecting VMware Horizon Client for Windows was privately reported to VMware. Updates are available to address this vulnerability in affected VMware product.
3. File system access control denial-of-service vulnerability (CVE-2020-3991)
VMware Horizon Client for Windows contains a denial-of-service vulnerability due to a file system access control issue during install time. VMware has evaluated the severity of this issue to be in the Moderate severity range with a maximum CVSSv3 base score of 5.9.
Known Attack Vectors
Successful exploitation of this issue may allow an attacker to overwrite certain admin privileged files through a symbolic link attack at install time. This will result into a denial-of-service condition on the machine where Horizon Client for Windows is installed.
To remediate CVE-2020-3991 apply the patches listed in the 'Fixed Version' column of the 'Response Matrix' below.
VMware would like to thank Eran Shimony of CyberArk for reporting this issue to us.
|Product||Version||Running On||CVE Identifier||CVSSv3||Severity||Fixed Version||Workarounds||Additional Documentation|
Horizon Client for Windows
5.x and prior
Fixed Version(s) and Release Notes:
Horizon Client for Windows 5.5.0
Downloads and Documentation:
Mitre CVE Dictionary Links:
FIRST CVSSv3 Calculator:
5. Change Log
Initial security advisory.
E-mail list for product security notifications and announcements:
This Security Advisory is posted to the following lists:
PGP key at:
VMware Security Advisories
VMware Security Response Policy
VMware Lifecycle Support Phases
VMware Security & Compliance Blog
Copyright 2020 VMware Inc. All rights reserved.