PT-2018-2866 · Vmware · Vmware Esxi+2

Publicado 2018-08-30 · Atualizado 2019-04-17 · CVE-2019-5520

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions VMware ESXi versions 6.7 before ESXi670-201904101-SG and 6.5 before ESXi650-201903001 VMware Workstation versions 15.x before 15.0.3 and 14.x before 14.1.6 VMware Fusion versions 11.x before 11.0.3 and 10.x before 10.1.6

Description The issue is related to an out-of-bounds read vulnerability in the memory, which may allow a remote attacker to disclose protected information. Exploitation of this issue requires access to a virtual machine with 3D graphics enabled. Successful exploitation may lead to information disclosure.

Recommendations For VMware ESXi versions 6.7 before ESXi670-201904101-SG and 6.5 before ESXi650-201903001, update to the latest version. For VMware Workstation versions 15.x before 15.0.3 and 14.x before 14.1.6, update to the latest version. For VMware Fusion versions 11.x before 11.0.3 and 10.x before 10.1.6, update to the latest version. As a temporary workaround, consider disabling the 3D-acceleration feature to minimize the risk of exploitation.

Correção

Out of bounds Read

Enumeração de Fraquezas

CWE-125

Identificadores relacionados

BDU:2019-02396

CVE-2019-5520

ZDI-19-369

Produtos afetados

Vmware Esxi

Vmware Fusion

Vmware Workstation

Referências · 5

• https://vmware.com/security/advisories/VMSA-2019-0006.html · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2019-02396 · Nota de Segurança
• https://zerodayinitiative.com/advisories/ZDI-19-369 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-5520 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-5520 · Nota de Segurança