CWE Code: 125
Vulnerability Type: privilege_escalation
CVSS Score: 5.8
CWE Name:  Out-of-bounds Read
Summary: vmware esxi (6.7 before esxi670-201904101-sg and 6.5 before esxi650-201903001), workstation (15.x before 15.0.3 and 14.x before 14.1.6), fusion (11.x before 11.0.3 and 10.x before 10.1.6) updates address an out-of-bounds vulnerability with the vertex shader functionality. exploitation of this issue requires an attacker to have access to a virtual machine with 3d graphics enabled. successful exploitation of this issue may lead to information disclosure or may allow attackers with normal user privileges to create a denial-of-service condition on their own vm. the workaround for this issue involves disabling the 3d-acceleration feature. this feature is not enabled by default on esxi and is enabled by default on workstation and fusion.
Access Authentication: NONE
Access Complexity: MEDIUM
Access Vector: NETWORK
Impact (C/I/A): PARTIAL/NONE/PARTIAL
Published Date: 2019-04-15
Last Modified Date: 2019-04-16