USN-7714-1 — open-vm-tools vulnerabilities

Summary

Matthias Gerstner discovered that Open VM Tools incorrectly handled file
descriptors when dropping privileges. A local attacker could possibly use
this issue to hijack /dev/uinput and simulate user inputs. (CVE-2023-34059)

Dolev Farhi discovered that Open VM Tools incorrectly handled certain file
permissions. A local attacker could possibly use this issue to setup a
symlink
attack and override files without authorization. (CVE-2014-4199)

Fixed packages 1

Release	Package	Fixed in
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS	open-vm-tools	2:9.4.0-1280544-5ubuntu6.4+esm1

Vulnerabilities 2

High 7.4

CVE-2023-34059

open-vm-tools contains a file descriptor hijack vulnerability in the vmware-user-suid-wrapper. A malicious actor with n…

open-vm-tools open-vm-tools open-vm-tools Debian Ubuntu Azure Linux

Oct 27, 2023
Unscored —

CVE-2014-4199

vm-support 0.88 in VMware Tools, as distributed with VMware Workstation through 10.0.3 and other products, allows local…

open-vm-tools open-vm-tools Debian Ubuntu

Aug 28, 2014

References

report
https://ubuntu.com/security/CVE-2014-4199
report
https://ubuntu.com/security/CVE-2023-34059

open-vm-tools vulnerabilities

Summary

Fixed packages 1

Vulnerabilities 2

open-vm-tools contains a file descriptor hijack vulnerability in the vmware-user-suid-wrapper. A malicious actor with n…

vm-support 0.88 in VMware Tools, as distributed with VMware Workstation through 10.0.3 and other products, allows local…

References