Security News > 2020 > November > VMware Working on Patches for Critical Workspace ONE Access Vulnerability
VMware on Monday published an advisory to inform users that it's working on patching a critical command injection vulnerability affecting Workspace ONE Access and some related components.
VMware has not specified if technical details of the vulnerability have been disclosed or if it has been exploited in attacks.
Workspace ONE Access, provides "Multi-factor authentication, conditional access and single sign-on to SaaS, web and native mobile apps." The vulnerability has been found to affect Workspace ONE Access on Linux, Identity Manager on Linux, vIDM Connector on Windows and Linux, VMware Cloud Foundation and vRealize Suite Lifecycle Manager.
VMware also informed customers recently that some of its Tanzu products are impacted by CVE-2020-15999, a vulnerability affecting FreeType, a popular software library for rendering fonts.
Earlier this month, VMware informed customers that it patched six vulnerabilities in its SD-WAN Orchestrator product, including flaws that can be exploited to steer traffic or shut down an enterprise network.
News URL
Related news
- VMware Releases vCenter Server Update to Fix Critical RCE Vulnerability (source)
- Critical Zimbra RCE vulnerability under mass exploitation (CVE-2024-45519) (source)
- Apple Releases Critical iOS and iPadOS Updates to Fix VoiceOver Password Vulnerability (source)
- Week in review: Critical Zimbra RCE vulnerability exploited, Patch Tuesday forecast (source)
- Experts Warn of Critical Unpatched Vulnerability in Linear eMerge E3 Systems (source)
- New Critical GitLab Vulnerability Could Allow Arbitrary CI/CD Pipeline Execution (source)
- Critical Veeam Vulnerability Exploited to Spread Akira and Fog Ransomware (source)
- Critical Kubernetes Image Builder Vulnerability Exposes Nodes to Root Access Risk (source)
- Fortinet releases patches for undisclosed critical FortiManager vulnerability (source)
- VMware fixes critical vCenter Server RCE bug – again! (CVE-2024-38812) (source)
Related Vulnerability
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2020-11-03 | CVE-2020-15999 | Out-of-bounds Write vulnerability in multiple products Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | 6.5 |