轉發 台灣電腦網路危機處理暨協調中心 TWCERTCC-200-202507-00000011
[內容說明]
1.【CVE-2025-41236，CVSS：9.3】 VMware ESXi、Workstation 和 Fusion 的 VMXNET3 虛擬網路介面卡存在整數溢位漏洞。
2.【CVE-2025-41237，CVSS：9.3】 VMware ESXi、 Workstation 和 Fusion 的 VMCI 存在整數下溢漏洞，可能導致越界寫入。
3.【CVE-2025-41238，CVSS：9.3】 VMware ESXi、Workstation 和 Fusion 的 PVSCSI 控制器存在堆疊溢位漏洞，可能導致越界寫入。
[影響平台]
● VMware Cloud Foundation
● VMware vSphere Foundation
● VMware ESXi
● VMware Workstation Pro
● VMware Fusion
● VMware Tools
● VMware Telco Cloud Platform
● VMware Telco Cloud Infrastructure
[建議措施]
根據官方網站釋出的解決方式進行修補：
https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/35877
[參考資料]
https://www.twcert.org.tw/tw/cp-169-10250-08712-1.html
Forwarded by Taiwan Computer Crisis Management and Coordination Center TWCERTCC-200-202507-00000011
[Content Description]
1. [CVE-2025-41236, CVSS: 9.3] The VMXNET3 virtual network interface card of VMware ESXi, Workstation and Fusion has an integer overflow vulnerability.
2. [CVE-2025-41237, CVSS: 9.3] An integer underflow vulnerability exists in VMCI of VMware ESXi, Workstation, and Fusion, which may lead to an out-of-bounds write.
3. [CVE-2025-41238, CVSS: 9.3] The PVSCSI controller of VMware ESXi, Workstation, and Fusion has a stack overflow vulnerability, which may lead to an out-of-bounds write.
[Influence Platform]
● VMware Cloud Foundation
● VMware vSphere Foundation
● VMware ESXi
● VMware Workstation Pro
● VMware Fusion
● VMware Tools
● VMware Telco Cloud Platform
● VMware Telco Cloud Infrastructure
[Suggested measures]
Repair according to the solution released by the official website:
https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/35877
[References]
https://www.twcert.org.tw/tw/cp-169-10250-08712-1.html