CVE-2018-6977

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

VMware ESXi (6.7, 6.5, 6.0), Workstation (15.x and 14.x) and Fusion (11.x and 10.x) contain a denial-of-service vulnerability due to an infinite loop in a 3D-rendering shader. Successfully exploiting this issue may allow an attacker with normal user privileges in the guest to make the VM unresponsive, and in some cases, possibly result other VMs on the host or the host itself becoming unresponsive.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Weakness enumeration

CWE-835

Affected software

Vendor	Product	Versions
VMware	ESXi	6.7, 6.5, 6.0
VMware	Workstation	15.x and 14.x
VMware	Fusion	11.x and 10.x

References

http://www.securityfocus.com/bid/105549Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1041821Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1041822Third Party Advisory, VDB Entry
https://www.vmware.com/security/advisories/VMSA-2018-0025.htmlMitigation, Vendor Advisory
http://www.securityfocus.com/bid/105549Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1041821Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1041822Third Party Advisory, VDB Entry
https://www.vmware.com/security/advisories/VMSA-2018-0025.htmlMitigation, Vendor Advisory

Timeline

Published: Oct 9, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-69786.7vRealize Operations (7.x before 7.0.0.11287810, 6.7.x before 6.7.0.11286837 and 6.6.x before 6.6.1.11286876) contains a local privilege esca CVE-2018-69797.4The VMware Workspace ONE Unified Endpoint Management Console (A/W Console) 9.7.x prior to 9.7.0.3, 9.6.x prior to 9.6.0.7, 9.5.x prior to 9.CVE-2018-69807.2VMware vRealize Log Insight (4.7.x before 4.7.1 and 4.6.x before 4.6.2) contains a vulnerability due to improper authorization in the user r CVE-2018-69818.8VMware ESXi 6.7 without ESXi670-201811401-BG and VMware ESXi 6.5 without ESXi650-201811301-BG, VMware ESXi 6.0 without ESXi600-201811401-BG,CVE-2018-69826.5VMware ESXi 6.7 without ESXi670-201811401-BG and VMware ESXi 6.5 without ESXi650-201811301-BG contain uninitialized stack memory usage in th CVE-2018-69838.8VMware Workstation (15.x before 15.0.2 and 14.x before 14.1.5) and Fusion (11.x before 11.0.2 and 10.x before 10.1.5) contain an integer ove CVE-2018-70327.5webcheckout in myrepos through 1.20171231 does not sanitize URLs that are passed to git clone, allowing a malicious website operator or a Mi CVE-2018-70339.8SchedMD Slurm before 17.02.10 and 17.11.x before 17.11.5 allows SQL Injection attacks against SlurmDBD.CVE-2018-70347.5TRENDnet TEW-751DR v1.03B03, TEW-752DRU v1.03B01, and TEW733GR v1.03B01 devices allow authentication bypass via an AUTHORIZED_GROUP=1 value,CVE-2018-70355.4Cross-site scripting (XSS) vulnerability in Gleez CMS 1.2.0 and 2.0 might allow remote attackers (users) to inject JavaScript via HTML conte CVE-2018-70399.8CCN-lite 2.0.0 Beta allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact because CVE-2018-70467.2Arbitrary code execution vulnerability in Kentico 9 through 11 allows remote authenticated users to execute arbitrary operating system comma