CVE-2019-5519

VMware ESXi (6.7 before ESXi670-201903001, 6.5 before ESXi650-201903001, 6.0 before ESXi600-201903001), Workstation (15.x before 15.0.4, 14.x before 14.1.7), Fusion (11.x before 11.0.3, 10.x before 10.1.6) contain a Time-of-check Time-of-use (TOCTOU) vulnerability in the virtual USB 1.1 UHCI (Universal Host Controller Interface). Exploitation of this issue requires an attacker to have access to a virtual machine with a virtual USB controller present. This issue may allow a guest to execute code on the host.

CVSS v2.0 7.2

7.2^/10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 10

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

Scope

CVSS v3.0 6.8 MEDIUM

6.8^/10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 0.9 / Impact : 5.9

Attack Vector PHYSICAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.vmware.com/security/advisories/VMSA-2019-0005.html	Vendor Advisory
http://packetstormsecurity.com/files/152290/VMware-Security-Advisory-2019-0005.html	Third Party Advisory VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-19-420/
http://www.securityfocus.com/bid/107535
http://www.securityfocus.com/bid/108443

Configurations

Configuration 1

cpe:2.3:a:vmware:fusion:*:*:*:*:*:*:*:*

cpe:2.3:a:vmware:workstation:*:*:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:6.0:-:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:6.0:600-201811001:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:6.0:600-201811401:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:6.5:-:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:6.5:650-201707201:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:6.5:650-201707202:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:6.5:650-201707203:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:6.5:650-201707204:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:6.5:650-201707205:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:6.5:650-201707206:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:6.5:650-201707207:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:6.5:650-201707208:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:6.5:650-201707209:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:6.5:650-201707210:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:6.5:650-201707211:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:6.5:650-201707212:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:6.5:650-201707213:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:6.5:650-201707214:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:6.5:650-201707215:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:6.5:650-201707216:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:6.5:650-201707217:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:6.5:650-201707218:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:6.5:650-201707219:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:6.5:650-201707220:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:6.5:650-201707221:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:6.5:650-201707102:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:6.5:650-201707101:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:6.5:650-201707103:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:6.5:650-201811001:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:6.5:650-201811301:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:6.7:-:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:6.7:670-201810201:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:6.7:670-201810202:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:6.7:670-201810203:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:6.7:670-201810204:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:6.7:670-201810205:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:6.7:670-201810206:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:6.7:670-201810207:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:6.7:670-201810208:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:6.7:670-201810209:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:6.7:670-201810210:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:6.7:670-201810211:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:6.7:670-201810212:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:6.7:670-201810213:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:6.7:670-201810214:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:6.7:670-201810215:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:6.7:670-201810216:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:6.7:670-201810217:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:6.7:670-201810218:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:6.7:670-201810219:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:6.7:670-201810220:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:6.7:670-201810221:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:6.7:670-201810222:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:6.7:670-201810223:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:6.7:670-201810224:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:6.7:670-201810225:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:6.7:670-201810226:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:6.7:670-201810227:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:6.7:670-201810228:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:6.7:670-201810229:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:6.7:670-201810230:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:6.7:670-201810231:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:6.7:670-201810232:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:6.7:670-201810233:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:6.7:670-201810234:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:6.7:670-201810101:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:6.7:670-201810102:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:6.7:670-201810103:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:6.7:670-201901401:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:6.7:670-201901402:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:6.7:670-201901403:*:*:*:*:*:*

History

24 Jan 2023, 16:19

Type	Values Removed	Values Added
CPE		cpe:2.3:a:predictapp_project:predictapp::::::::
References	~~(MISC) https://github.com/abhilash1985/PredictApp/commit/b067372f3ee26fe1b657121f0f41883ff4461a06 -~~	(MISC) https://github.com/abhilash1985/PredictApp/commit/b067372f3ee26fe1b657121f0f41883ff4461a06 - Patch, Third Party Advisory
References	~~(MISC) https://github.com/abhilash1985/PredictApp/pull/73 -~~	(MISC) https://github.com/abhilash1985/PredictApp/pull/73 - Patch, Third Party Advisory
References	~~(MISC) https://vuldb.com/?id.218387 -~~	(MISC) https://vuldb.com/?id.218387 - Third Party Advisory
References	~~(MISC) https://vuldb.com/?ctiid.218387 -~~	(MISC) https://vuldb.com/?ctiid.218387 - Third Party Advisory
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 9.8
First Time		Predictapp Project predictapp Predictapp Project

16 Jan 2023, 13:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2019-04-01 09:30

Updated : 2020-08-24 05:37

NVD link : CVE-2019-5519

Mitre link : CVE-2019-5519

Products Affected

No products.

CWE

CWE-367