CVE-2019-5515: VMware Workstation e1000 Out-Of-Bounds Write Privilege Escalation Vulnerability
First published: Tue Apr 02 2019(Updated: )
This vulnerability allows local attackers to execute arbitrary code on vulnerable installations of VMware Workstation. An attacker must first obtain the ability to execute low-privileged code on the guest system in order to exploit this vulnerability. The specific flaw exists within the handling of virtualized e1000 devices. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the host OS.
Credit: security@vmware.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| VMware Workstation | ||
| VMware Fusion | >=10.0.0<10.1.6 | |
| VMware Fusion | >=11.0.0<11.0.3 | |
| VMware Workstation | >=14.0.0<14.1.6 | |
| VMware Workstation | >=15.0.0<15.0.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2019-5515.
What is the title of the vulnerability?
The title of the vulnerability is VMware Workstation e1000 Memory Corruption Privilege Escalation Vulnerability.
What is the severity of CVE-2019-5515?
The severity of CVE-2019-5515 is critical with a score of 8.8.
Which software products are affected by CVE-2019-5515?
VMware Workstation versions 14.0.0 to 14.1.6 and 15.0.0 to 15.0.3, as well as VMware Fusion versions 10.0.0 to 10.1.6 and 11.0.0 to 11.0.3 are affected.
How can an attacker exploit CVE-2019-5515?
In order to exploit CVE-2019-5515, an attacker must first obtain the ability to execute low-privileged code on the guest system.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/references
- agent/last-modified-date
- agent/author
- agent/title
- agent/weakness
- agent/tags
- agent/description
- agent/event
- agent/first-publish-date
- collector/zdi-advisory
- source/ZDI
- alias/ZDI-19-306
- alias/ZDI-CAN-7450
- alias/CVE-2019-5515
- agent/software-canonical-lookup
- alias/ZDI-19-516
- alias/ZDI-CAN-7804
- vendor/vmware
- canonical/vmware fusion
- version/vmware fusion/10.0.0
- version/vmware fusion/11.0.0
- canonical/vmware workstation
- version/vmware workstation/14.0.0
- version/vmware workstation/15.0.0