Security Alert (A18-10-06): Vulnerability in VMware Products

Description:

VMware has published a security advisory to address an out-of-bounds read vulnerability in VMware vSphere ESXi (ESXi) version 6.0, 6.5 and 6.7, VMware Workstation version 14.x and VMWare Fusion version 10.x.

Affected Systems:

• VMware vSphere ESXi (ESXi) version 6.0, 6.5 and 6.7
• VMware Workstation version 14.x
• VMware Fusion version 10.x

Impact:

Successful exploitation of the vulnerabilities could allow a guest to execute code on the host.

Recommendation:

The product vendor has released new versions to address the issue at the vendor's website:

• VMware vSphere ESXi (ESXi) version 6.0, 6.5 or 6.7
  https://my.vmware.com/group/vmware/patch
  
  
• VMware Workstation Pro 14.1.3
  https://www.vmware.com/go/downloadworkstation
  
  
• VMware Workstation Player 14.1.3
  https://www.vmware.com/go/downloadplayer
  
  
• VMware Fusion Pro/ Fusion 10.1.3
  https://www.vmware.com/go/downloadfusion
  
  

System administrators may contact their product support vendors for the fixes and assistance.

More Information:

https://www.vmware.com/security/advisories/VMSA-2018-0026.html
https://www.us-cert.gov/ncas/current-activity/2018/10/16/VMware-Releases-Security-Updates
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6974