Out-of-bounds write in Broadcom products - CVE-2019-5684
Published: August 2, 2019
Vulnerability identifier: #VU19921
CSH Severity: Medium
CVSS v4: 7.5 [CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-5684
CWE-ID: CWE-125
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a boundary error when processing untrusted input. A remote unprivileged user with access to a guest operating system can trigger out-of-bounds write and execute arbitrary code on the target system.
Note, the vulnerability can be exploited only if the host has an affected NVIDIA graphics driver.
Affected software
VMware ESXi
VMware Fusion
VMware Workstation
EMC Integrated Data Protection Appliance
VMware Fusion
VMware Workstation
EMC Integrated Data Protection Appliance
How to mitigate CVE-2019-5684
Install updates from vendor's website.
VMware Fusion - addressed in versions 10.1.6, 11.0.3
VMware Workstation - addressed in versions 14.1.6, 15.0.3
EMC Integrated Data Protection Appliance - update to 2.3.1
VMware Workstation - addressed in versions 14.1.6, 15.0.3
EMC Integrated Data Protection Appliance - update to 2.3.1