Buffer overflow in VMware Fusion
CVE-2019-5515
VMware Workstation (15.x before 15.0.3, 14.x before 14.1.6) and Fusion (11.x before 11.0.3, 10.x before 10.1.6) updates address an out-of-bounds write vulnerability in the e1000 and e1000e virtual network adapters. Exploitation of this issue may lead to code execution on the host from the guest but it is more likely to result in a denial of service of the guest.
Vulnerability class: Buffer Overflow
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.042 (90.8th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 91st percentile — 90.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.035 · newest: 0.042 · change: +0.006
Affected products
- VMware Fusion
- VMware Workstation And Fusion — versions Workstation 15.x before 15.0.3, Workstation 14.x before 14.1.6, Fusion 11.x before 11.0.3
- VMware Workstation
Weakness classification (CWE)
References
- www.vmware.com/security/advisories/VMSA-2019-0005.html (Vendor Advisory)
- www.zerodayinitiative.com/advisories/ZDI-19-306/ (VDB Entry, Third Party Advisory)
- www.securityfocus.com/bid/107634 (VDB Entry, Third Party Advisory, vdb-entry)
- packetstormsecurity.com/files/152290/VMware-Security-Advisory-2019-0005.html (VDB Entry, Third Party Advisory)
- www.zerodayinitiative.com/advisories/ZDI-19-516/
Frequently asked questions
- What is CVE-2019-5515?
- CVE-2019-5515 is a high-severity vulnerability in VMware Fusion, classified under Out-of-bounds Write. CVSS score: 8.8/10. Published 2019-04-02.
- How severe is CVE-2019-5515?
- High severity. CVSS v3 base score is 8.8 out of 10.