【資安漏洞預警】VMware ESXi、Workstation、Fusion 和 Tools 存在3個重大資安漏洞

【行政公告】

公告單位	計算機與資訊網路中心
訊息類別	行政公告行政公告	公告對象	全體
公告主題	【資安漏洞預警】VMware ESXi、Workstation、Fusion 和 Tools 存在3個重大資安漏洞 [Security Vulnerability Alert] VMware ESXi, Workstation, Fusion and Tools have 3 major security vulnerabilities
公告內容	轉發台灣電腦網路危機處理暨協調中心 TWCERTCC-200-202507-00000011 [內容說明] 1.【CVE-2025-41236，CVSS：9.3】 VMware ESXi、Workstation 和 Fusion 的 VMXNET3 虛擬網路介面卡存在整數溢位漏洞。 2.【CVE-2025-41237，CVSS：9.3】 VMware ESXi、 Workstation 和 Fusion 的 VMCI 存在整數下溢漏洞，可能導致越界寫入。 3.【CVE-2025-41238，CVSS：9.3】 VMware ESXi、Workstation 和 Fusion 的 PVSCSI 控制器存在堆疊溢位漏洞，可能導致越界寫入。 [影響平台] ● VMware Cloud Foundation ● VMware vSphere Foundation ● VMware ESXi ● VMware Workstation Pro ● VMware Fusion ● VMware Tools ● VMware Telco Cloud Platform 　 ● VMware Telco Cloud Infrastructure [建議措施] 根據官方網站釋出的解決方式進行修補： https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/35877 [參考資料] https://www.twcert.org.tw/tw/cp-169-10250-08712-1.html Forwarded by Taiwan Computer Crisis Management and Coordination Center TWCERTCC-200-202507-00000011 [Content Description] 1. [CVE-2025-41236, CVSS: 9.3] The VMXNET3 virtual network interface card of VMware ESXi, Workstation and Fusion has an integer overflow vulnerability. 2. [CVE-2025-41237, CVSS: 9.3] An integer underflow vulnerability exists in VMCI of VMware ESXi, Workstation, and Fusion, which may lead to an out-of-bounds write. 3. [CVE-2025-41238, CVSS: 9.3] The PVSCSI controller of VMware ESXi, Workstation, and Fusion has a stack overflow vulnerability, which may lead to an out-of-bounds write. [Influence Platform] ● VMware Cloud Foundation ● VMware vSphere Foundation ● VMware ESXi ● VMware Workstation Pro ● VMware Fusion ● VMware Tools ● VMware Telco Cloud Platform ● VMware Telco Cloud Infrastructure [Suggested measures] Repair according to the solution released by the official website: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/35877 [References] https://www.twcert.org.tw/tw/cp-169-10250-08712-1.html
相關訊息
公告時間	2025/7/17 至 2026/1/17	點閱次數	102