Today, VMware has released the following new security advisory:
VMSA-2019-0006 – VMware ESXi, Workstation and Fusion updates address multiple out-of-bounds read vulnerabilities
This advisory documents Important Severity issues.
Issue (a) VMware ESXi, Workstation and Fusion updates address an out-of-bounds vulnerability (CVE-2019-5516) with the vertex shader functionality. Exploitation of this issue requires an attacker to have access to a virtual machine with 3D graphics enabled. Successful exploitation of this issue may lead to information disclosure or may allow attackers with normal user privileges to create a denial-of-service condition on their own VM. The workaround for this issue involves disabling the 3D-acceleration feature. This feature is not enabled by default on ESXi and is enabled by default on Workstation and Fusion.
VMware would like to thank Piotr Bania of Cisco Talos for reporting this issue to us.
Issue (b) VMware ESXi, Workstation and Fusion contain multiple out-of-bounds read vulnerabilities (CVE-2019-5517) in the shader translator. Exploitation of these issues requires an attacker to have access to a virtual machine with 3D graphics enabled. Successful exploitation of these issues may lead to information disclosure or may allow attackers with normal user privileges to create a denial-of-service condition on their own VM. The workaround for these issues involves disabling the 3D-acceleration feature. This feature is not enabled by default on ESXi and is enabled by default on Workstation and Fusion.
VMware would like to thank RanchoIce of Tencent Security ZhanluLab for reporting these issues to us.
Issue (c) VMware ESXi, Workstation and Fusion contain an out-of-bounds read vulnerability (CVE-2019-5520). Exploitation of this issue requires an attacker to have access to a virtual machine with 3D graphics enabled. Successful exploitation of this issue may lead to information disclosure.
VMware would like to thank instructor working with Trend Micro’s Zero Day Initiative for reporting this issue to us.
Please sign up to the Security-Announce mailing list to receive new and updated VMware Security Advisories.
Customers should review the security advisories and direct any questions to VMware Support.
