https://www.vmware.com/security/advisories/VMSA-2023-0008.html

The version of VMware Workstation installed on the remote host is 17.0.x prior to 17.0.2. It is, therefore, affected by multiple vulnerabilities.

  - VMware Workstation (17.x) and VMware Fusion (13.x) contain a stack-based buffer-overflow vulnerability     that exists in the functionality for sharing host Bluetooth devices with the virtual machine.
    (CVE-2023-20869)

  - VMware Workstation and Fusion contain an out-of-bounds read vulnerability that exists in the functionality     for sharing host Bluetooth devices with the virtual machine. (CVE-2023-20870)

  - VMware Fusion contains a local privilege escalation vulnerability. A malicious actor with read/write     access to the host operating system can elevate privileges to gain root access to the host operating     system. (CVE-2023-20871)

  - VMware Workstation and Fusion contain an out-of-bounds read/write vulnerability in SCSI CD/DVD device     emulation. (CVE-2023-20872)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of VMware Fusion installed on the remote macOS or Mac OS X host is 13.0.x prior to 13.0.2. It is, therefore, affected by multiple vulnerabilities.

  - VMware Workstation (17.x) and VMware Fusion (13.x) contain a stack-based buffer-overflow vulnerability     that exists in the functionality for sharing host Bluetooth devices with the virtual machine.
    (CVE-2023-20869)

  - VMware Workstation and Fusion contain an out-of-bounds read vulnerability that exists in the functionality     for sharing host Bluetooth devices with the virtual machine. (CVE-2023-20870)

  - VMware Fusion contains a local privilege escalation vulnerability. A malicious actor with read/write     access to the host operating system can elevate privileges to gain root access to the host operating     system. (CVE-2023-20871)

  - VMware Workstation and Fusion contain an out-of-bounds read/write vulnerability in SCSI CD/DVD device     emulation. (CVE-2023-20872)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
174758	VMware Workstation 17.0.x < 17.0.2 Multiple Vulnerabilities (VMSA-2023-0008)	Nessus	General	high
174757	VMware Fusion 13.0.x < 13.0.2 Multiple Vulnerabilities (VMSA-2023-0008)	Nessus	MacOS X Local Security Checks	high

CVE-2023-20870

medium

Tenable Plugins

high

high