CWE Code: 125
Vulnerability Type: privilege_escalation
CVSS Score: 5.8
CWE Name:  Out-of-bounds Read
Summary: vmware esxi (6.7 before esxi670-201904101-sg and 6.5 before esxi650-201903001), workstation (15.x before 15.0.3 and 14.x before 14.1.6), fusion (11.x before 11.0.3 and 10.x before 10.1.6) contain multiple out-of-bounds read vulnerabilities in the shader translator. exploitation of these issues requires an attacker to have access to a virtual machine with 3d graphics enabled. successful exploitation of these issues may lead to information disclosure or may allow attackers with normal user privileges to create a denial-of-service condition on their own vm. the workaround for these issues involves disabling the 3d-acceleration feature. this feature is not enabled by default on esxi and is enabled by default on workstation and fusion.
Access Authentication: NONE
Access Complexity: MEDIUM
Access Vector: NETWORK
Impact (C/I/A): PARTIAL/NONE/PARTIAL
Published Date: 2019-04-15
Last Modified Date: 2019-04-16