vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2019-5519

N/A
Published: April 1, 2019 at 08:39 PM UTC
Updated: June 17, 2026 at 02:37 AM UTC
3 products affected across 1 vendorWorkstationESXiFusion

Using VMware ESXi, Workstation, Fusion by VMware?

Get instant alerts when new vulnerabilities affect VMware ESXi, Workstation, Fusion - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
N/A
Exploit prediction
EPSS 1%

Description

VMware ESXi (6.7 before ESXi670-201903001, 6.5 before ESXi650-201903001, 6.0 before ESXi600-201903001), Workstation (15.x before 15.0.4, 14.x before 14.1.7), Fusion (11.x before 11.0.3, 10.x before 10.1.6) contain a Time-of-check Time-of-use (TOCTOU) vulnerability in the virtual USB 1.1 UHCI (Universal Host Controller Interface). Exploitation of this issue requires an attacker to have access to a virtual machine with a virtual USB controller present. This issue may allow a guest to execute code on the host.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

ESXi· VMware
95%
v < 10.1.6v < 11.0.3v < 14.1.7v < 15.0.46.06.0 600-2018110016.0 600-2018114016.56.5 650-2017071016.5 650-2017071026.5 650-2017071036.5 650-2017072016.5 650-2017072026.5 650-2017072036.5 650-2017072046.5 650-2017072056.5 650-2017072066.5 650-2017072076.5 650-2017072086.5 650-2017072096.5 650-2017072106.5 650-2017072116.5 650-2017072126.5 650-2017072136.5 650-2017072146.5 650-2017072156.5 650-2017072166.5 650-2017072176.5 650-2017072186.5 650-2017072196.5 650-2017072206.5 650-2017072216.5 650-2018110016.5 650-2018113016.76.7 670-2018101016.7 670-2018101026.7 670-2018101036.7 670-2018102016.7 670-2018102026.7 670-2018102036.7 670-2018102046.7 670-2018102056.7 670-2018102066.7 670-2018102076.7 670-2018102086.7 670-2018102096.7 670-2018102106.7 670-2018102116.7 670-2018102126.7 670-2018102136.7 670-2018102146.7 670-2018102156.7 670-2018102166.7 670-2018102176.7 670-2018102186.7 670-2018102196.7 670-2018102206.7 670-2018102216.7 670-2018102226.7 670-2018102236.7 670-2018102246.7 670-2018102256.7 670-2018102266.7 670-2018102276.7 670-2018102286.7 670-2018102296.7 670-2018102306.7 670-2018102316.7 670-2018102326.7 670-2018102336.7 670-2018102346.7 670-2019014016.7 670-2019014026.7 670-201901403ESXi 6.0 before ESXi600-201903001ESXi 6.5 before ESXi650-201903001ESXi 6.7 before ESXi670-201903001
Affected range stops below 10.1.6, so it looks safe — our inference, not a vendor statement
Affected range stops below 11.0.3, so it looks safe — our inference, not a vendor statement
Affected range stops below 14.1.7, so it looks safe — our inference, not a vendor statement
Affected range stops below 15.0.4, so it looks safe — our inference, not a vendor statement
Fusion· VMware
95%
v < 10.1.6v < 11.0.3v < 14.1.7v < 15.0.410.0.0 ≤ v < 10.1.611.0.0 ≤ v < 11.0.3ESXi 6.0 before ESXi600-201903001ESXi 6.5 before ESXi650-201903001ESXi 6.7 before ESXi670-201903001
Affected range stops below 10.1.6, so it looks safe — our inference, not a vendor statement
Affected range stops below 11.0.3, so it looks safe — our inference, not a vendor statement
Affected range stops below 14.1.7, so it looks safe — our inference, not a vendor statement
Affected range stops below 15.0.4, so it looks safe — our inference, not a vendor statement
Workstation· VMware
95%
v < 10.1.6v < 11.0.3v < 14.1.7v < 15.0.414.0.0 ≤ v < 14.1.715.0.0 ≤ v < 15.0.4ESXi 6.0 before ESXi600-201903001ESXi 6.5 before ESXi650-201903001ESXi 6.7 before ESXi670-201903001
Affected range stops below 10.1.6, so it looks safe — our inference, not a vendor statement
Affected range stops below 11.0.3, so it looks safe — our inference, not a vendor statement
Affected range stops below 14.1.7, so it looks safe — our inference, not a vendor statement
Affected range stops below 15.0.4, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (5)

x_refsource_MISCThird Party AdvisoryVDB Entry
Source: [email protected]
http://packetstormsecurity.com/files/152290/VMware-Security-Advisory-2019-0005.html
VDB Entryx_refsource_BID
Source: [email protected]
http://www.securityfocus.com/bid/107535
VDB Entryx_refsource_BID
Source: [email protected]
http://www.securityfocus.com/bid/108443
x_refsource_CONFIRMVendor Advisory
Source: [email protected]
https://www.vmware.com/security/advisories/VMSA-2019-0005.html
x_refsource_MISC
Source: [email protected]
https://www.zerodayinitiative.com/advisories/ZDI-19-420/

CVSS

7.2HIGH[email protected]
Confidentiality
COMPLETE
Integrity
COMPLETE
Availability
COMPLETE
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-367

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card