PT-2018-2866 · Vmware · Vmware Esxi+2

Published 2018-08-30 · Updated 2019-04-17 · CVE-2019-5520

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions VMware ESXi versions 6.7 before ESXi670-201904101-SG and 6.5 before ESXi650-201903001 VMware Workstation versions 15.x before 15.0.3 and 14.x before 14.1.6 VMware Fusion versions 11.x before 11.0.3 and 10.x before 10.1.6

Description The issue is related to an out-of-bounds read vulnerability in the memory, which may allow a remote attacker to disclose protected information. Exploitation of this issue requires access to a virtual machine with 3D graphics enabled. Successful exploitation may lead to information disclosure.

Recommendations For VMware ESXi versions 6.7 before ESXi670-201904101-SG and 6.5 before ESXi650-201903001, update to the latest version. For VMware Workstation versions 15.x before 15.0.3 and 14.x before 14.1.6, update to the latest version. For VMware Fusion versions 11.x before 11.0.3 and 10.x before 10.1.6, update to the latest version. As a temporary workaround, consider disabling the 3D-acceleration feature to minimize the risk of exploitation.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

BDU:2019-02396

CVE-2019-5520

ZDI-19-369

Affected Products

Vmware Esxi

Vmware Fusion

Vmware Workstation

References · 5

• https://vmware.com/security/advisories/VMSA-2019-0006.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-02396 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-19-369 · Security Note
• https://osv.dev/vulnerability/CVE-2019-5520 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-5520 · Security Note