Network Security, Patch/Configuration Management, Vulnerability Management

VMware repairs out-of-bounds read bug in three Horizon products

Share

VMware this week updated its Horizon 6, Horizon 7 and Horizon Client for Windows solutions to fix an important out-of-bounds read vulnerability in the Message Framework library.

"Successfully exploiting this issue may allow a less-privileged user to leak information from a privileged process running on a system where Horizon Connection Server, Horizon Agent or Horizon Client are installed," warns an Aug. 7 security advisory from VMware.

VMware's Horizon Client software is designed to connect endpoint devices with virtual desktops and applications via the company's Horizon View desktop virtualization product.

Designated CVE-2018-6970, the bug does not apply to Horizon products installed on Linux or other non-Windows systems. Horizon 6, 7 and Client for Windows are fixed with versions 6.2.7, 7.5.1 and 4.8.1, respectively.

The vulnerability's discovery has been credited to Steven Seeley of Source Incite, working in conjunction with Trend Micro's Zero Day Initiative.

VMware repairs out-of-bounds read bug in three Horizon products

VMware this week updated its Horizon 6, Horizon 7 and Horizon Client for Windows solutions to fix an important out-of-bounds read vulnerability in the Message Framework library.

Bradley Barth

As director of multimedia content strategy at CyberRisk Alliance, Bradley Barth develops content for online conferences, webcasts, podcasts video/multimedia projects — often serving as moderator or host. For nearly six years, he wrote and reported for SC Media as deputy editor and, before that, senior reporter. He was previously a program executive with the tech-focused PR firm Voxus. Past journalistic experience includes stints as business editor at Executive Technology, a staff writer at New York Sportscene and a freelance journalist covering travel and entertainment. In his spare time, Bradley also writes screenplays.

Related

Another record-breaking DDoS intrusion thwarted

Such record-breaking intrusion has been thwarted alongside more than 100 other hyper-volumetric L3/4 DDoS attacks of similar intensity that have been launched against organizations in the telecommunications, financial services, and internet industries as part of a campaign that began early last month.

Related Events

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms of Use and Privacy Policy.