ESXi, Workstation, Fusion, VMRC and Horizon Client contain a use-after-free vulnerability in the virtual sound device. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 8.5.

The version of VMware Horizon View Client installed on the remote host is 5.x prior to 5.2.0. It is, therefore, affected by a use-after-free error in the virtual sound device that allows a local attacker on the guest machine with low privileges to execute code on the host.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote VMware ESXi host is version 6.0, 6.5 or 6.7 and is affected by a use-after-free error in the virtual sound device that allows a local attacker on the guest machine with low privileges to execute code on the host.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of VMware Fusion installed on the remote macOS or Mac OS X host is 11.0.x prior to 11.5.0. It is, therefore, affected by the following issues:

  - A use-after-free error in the virtual sound device that     allows a local attacker on the guest machine with low     privileges to execute code on the host. (CVE-2019-5527)

  - A denial of service vulnerability caused by improper     handling of some IPv6 packets. An attacker can exploit     this vulnerability to disallow network access for all     guest machines using the VMware NAT mode. To exploit     this vulnerability, the attacker must send specially     crafted IPv6 packets from a guest machine when IPv6 mode     for VMNAT is enabled. (CVE-2019-5535)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of VMware Workstation installed on the remote host is 15.0.x prior to 15.5.0. It is, therefore, affected by the following issues:

  - A use-after-free error in the virtual sound device that     allows a local attacker on the guest machine with low     privileges to execute code on the host. (CVE-2019-5527)

  - A denial of service vulnerability caused by improper     handling of some IPv6 packets. An attacker can exploit     this vulnerability to disallow network access for all     guest machines using the VMware NAT mode. To exploit     this vulnerability, the attacker must send specially     crafted IPv6 packets from a guest machine when IPv6 mode     for VMNAT is enabled. (CVE-2019-5535)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ESXi use-after-free vulnerability - CVE-2019-5527

ESXi, Workstation, Fusion, VMRC and Horizon Client contain a use-after-free vulnerability in the virtual sound device.

A local attacker with non-administrative access on the guest machine may exploit this issue to execute code on the host. This issue can only be exploited if a valid sound back-end is not connected.

ID	Name	Product	Family	Type	Severity
129498	VMware Horizon View Client 5.x < 5.2.0 Use-After-Free (VMSA-2019-0014)	Nessus	Misc.	Local	high
129497	ESXi 6.0 / 6.5 / 6.7 Use-After-Free (VMSA-2019-0014)	Nessus	Misc.	Remote	high
129496	VMware Fusion 11.0.x < 11.5.0 Multiple Vulnerabilities (VMSA-2019-0014)	Nessus	MacOS X Local Security Checks	Local	high
129495	VMware Workstation 15.0.x < 15.5.0 Multiple Vulnerabilities (VMSA-2019-0014)	Nessus	General	Local	high
129161	VMSA-2019-0014 : Use-after-free vulnerability	Nessus	VMware ESX Local Security Checks	Local	high

Detections

Analytics

CVE-2019-5527

high

Tenable Plugins

high

high

high

high

high