Information disclosure in VMware Fusion and VMware Workstation - CVE-2019-5540
Published: November 13, 2019
Vulnerability identifier: #VU22738
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-5540
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to information disclosure issue in vmnetdhcp. A remote authenticated attacker can leak memory from the host process and gain unauthorized access to sensitive information on the system.
Affected software
VMware Fusion
VMware Workstation
VMware Workstation
How to mitigate CVE-2019-5540
Install updates from vendor's website.
VMware Fusion - update to 11.5.1
VMware Workstation - update to 15.5.1
VMware Workstation - update to 15.5.1