CVE-2019-5544

CVE-2019-5544 is a critical-severity (CVSS 9.8) vulnerability in VMware VMware ESXi and Horizon DaaS. CISA added it to the Known Exploited Vulnerabilities catalog on November 3, 2021, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by May 3, 2022. CISA also lists it as known to be used in ransomware campaigns, so it should be prioritised accordingly. VMware has 26 vulnerabilities in the KEV catalog, 9 of them linked to ransomware.

OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• http://www.openwall.com/lists/oss-security/2019/12/10/2
• http://www.openwall.com/lists/oss-security/2019/12/11/2
• http://www.vmware.com/security/advisories/VMSA-2019-0022.html
• https://access.redhat.com/errata/RHSA-2019:4240
• https://access.redhat.com/errata/RHSA-2020:0199
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DA3LYAJ2NRKMOZLZOQNDJ5TNQRFMWGHF/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZPXXJZLPLAQULBCJVI5NNWZ3PGWXGXWG/
• https://security.gentoo.org/glsa/202005-12