CVE-2019-5517

N/A

Published: April 15, 2019 at 05:20 PM UTC

Updated: June 17, 2026 at 02:37 AM UTC

3 products affected across 1 vendorWorkstationESXiFusion

Using ESXi by VMware?

Get instant alerts when new vulnerabilities affect ESXi - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

N/A

Exploit prediction

EPSS 1%

Description

VMware ESXi (6.7 before ESXi670-201904101-SG and 6.5 before ESXi650-201903001), Workstation (15.x before 15.0.3 and 14.x before 14.1.6), Fusion (11.x before 11.0.3 and 10.x before 10.1.6) contain multiple out-of-bounds read vulnerabilities in the shader translator. Exploitation of these issues requires an attacker to have access to a virtual machine with 3D graphics enabled. Successful exploitation of these issues may lead to information disclosure or may allow attackers with normal user privileges to create a denial-of-service condition on their own VM. The workaround for these issues involves disabling the 3D-acceleration feature. This feature is not enabled by default on ESXi and is enabled by default on Workstation and Fusion.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

ESXi · VMware

95%

6.5 6.5 650-201701001 6.5 650-201703001 6.5 650-201703002 6.5 650-201704001 6.5 650-201707101 6.5 650-201707102 6.5 650-201707103 6.5 650-201707201 6.5 650-201707202 6.5 650-201707203 6.5 650-201707204 6.5 650-201707205 6.5 650-201707206 6.5 650-201707207 6.5 650-201707208 6.5 650-201707209 6.5 650-201707210 6.5 650-201707211 6.5 650-201707212 6.5 650-201707213 6.5 650-201707214 6.5 650-201707215 6.5 650-201707216 6.5 650-201707217 6.5 650-201707218 6.5 650-201707219 6.5 650-201707220 6.5 650-201707221 6.5 650-201710001 6.5 650-201712001 6.5 650-201803001 6.5 650-201806001 6.5 650-201808001 6.5 650-201810001 6.5 650-201810002 6.5 650-201811001 6.5 650-201811002 6.5 650-201811301 6.5 650-201901001 6.5 before ESXi650-201903001 6.7 6.7 670-201806001 6.7 670-201807001 6.7 670-201808001 6.7 670-201810001 6.7 670-201810101 6.7 670-201810102 6.7 670-201810103 6.7 670-201810201 6.7 670-201810202 6.7 670-201810203 6.7 670-201810204 6.7 670-201810205 6.7 670-201810206 6.7 670-201810207 6.7 670-201810208 6.7 670-201810209 6.7 670-201810210 6.7 670-201810211 6.7 670-201810212 6.7 670-201810213 6.7 670-201810214 6.7 670-201810215 6.7 670-201810216 6.7 670-201810217 6.7 670-201810218 6.7 670-201810219 6.7 670-201810220 6.7 670-201810221 6.7 670-201810222 6.7 670-201810223 6.7 670-201810224 6.7 670-201810225 6.7 670-201810226 6.7 670-201810227 6.7 670-201810228 6.7 670-201810229 6.7 670-201810230 6.7 670-201810231 6.7 670-201810232 6.7 670-201810233 6.7 670-201810234 6.7 670-201811001 6.7 670-201901001 6.7 670-201901401 6.7 670-201901402 6.7 670-201901403 6.7 670-201904201 6.7 670-201904202 6.7 670-201904203 6.7 670-201904204 6.7 670-201904205 6.7 670-201904206 6.7 670-201904207 6.7 670-201904208 6.7 670-201904209 6.7 670-201904210 6.7 670-201904211 6.7 670-201904212 6.7 670-201904213 6.7 670-201904214 6.7 670-201904215 6.7 670-201904216 6.7 670-201904217 6.7 670-201904218 6.7 670-201904219 6.7 670-201904220 6.7 670-201904221 6.7 670-201904222 6.7 670-201904223 6.7 670-201904224 6.7 670-201904225 6.7 670-201904226 6.7 670-201904227 6.7 670-201904228 6.7 670-201904229 6.7 before ESXi670-201904101-SG

Fusion · VMware

95%

10 ≤ v < 10.1.610.0.0 ≤ v < 10.1.611 ≤ v < 11.0.311.0.0 ≤ v < 11.0.3

Affected range stops below 10.1.6, so it looks safe — our inference, not a vendor statement

Affected range stops below 11.0.3, so it looks safe — our inference, not a vendor statement

Workstation · VMware

95%

14 ≤ v < 14.1.614.0.0 ≤ v < 14.1.615 ≤ v < 15.0.315.0.0 ≤ v < 15.0.3

Affected range stops below 14.1.6, so it looks safe — our inference, not a vendor statement

Affected range stops below 15.0.3, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

https://www.vmware.com/security/advisories/VMSA-2019-0006.html

References (1)

x_refsource_CONFIRMPatchVendor Advisory

Source: [email protected]

https://www.vmware.com/security/advisories/VMSA-2019-0006.html

CVSS

5.8MEDIUM[email protected]

Confidentiality: PARTIAL
Integrity: NONE
Availability: PARTIAL

Vector?

Quick Info

StatusMODIFIED

CWE

CWE-125

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card