Security Bulletin: IBM PureApplication System is affected by vulnerabilities in VMWare component (CVE-2018-6981 CVE-2018-6982)

Vulnerability Details

CVEID: CVE-2018-6981
DESCRIPTION: VMware ESXi, Workstation, and Fusion could allow a remote attacker to execute arbitrary code on the system, caused by an issue with uninitialized stack memory usage in the vmxnet3 virtual network adapter. If vmxnet3 is enabled, an attacker could exploit this vulnerability to execute arbitrary code and gain elevated privileges on the host system.
CVSS Base Score: 10
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/152791 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)

CVEID: CVE-2018-6982
DESCRIPTION: VMware ESXi, Workstation, and Fusion could allow a remote attacker to obtain sensitive information, caused by an issue with uninitialized stack memory usage in the vmxnet3 virtual network adapter. If vmxnet3 is enabled, an attacker could exploit this vulnerability to obtain sensitive information leaked from the host to the guest domain.
CVSS Base Score: 8.6
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/152792 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N)