Vulnerability in Vmware Esxi

CVE-2019-5536

VMware ESXi (6.7 before ESXi670-201908101-SG and 6.5 before ESXi650-201910401-SG), Workstation (15.x before 15.5.0) and Fusion (11.x before 11.5.0) contain a denial-of-service vulnerability in the shader functionality. Successful exploitation of this issue may allow attackers with normal user privileges to create a denial-of-service condition on their own VM. Exploitation of this issue require an attacker to have access to a virtual machine with 3D graphics enabled. It is not enabled by default on ESXi and is enabled by default on Workstation and Fusion.

EPSS: 0.021 (79.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.

Affected products

  • Vmware Esxi — versions 6.5, 6.7
  • Vmware Fusion
  • Vmware Workstation
  • N/a Vmware Esxi, Workstation And Fusion — versions VMware ESXi (6.7 before ESXi670-201908101-SG and 6.5 before ESXi650-201910401-SG), Workstation (15.x before 15.5.0) and Fusion (11.x before 11.5.0)

References

Frequently asked questions

What is CVE-2019-5536?
CVE-2019-5536 is a medium-severity vulnerability in Vmware Esxi. CVSS score: 6.5/10. Published 2019-10-28.
How severe is CVE-2019-5536?
Medium severity. CVSS v3 base score is 6.5 out of 10.