PT-2017-6828 · Vmware+1 · Vmware Tools+1

Published 2017-03-15 · Updated 2024-06-15 · CVE-2015-5191

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Medium

Base vector

AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions VMware Tools versions prior to 10.0.9

Description The issue is related to multiple file system races in libDeployPkg, which uses hard-coded paths under /tmp. This could potentially lead to a local privilege escalation if successfully exploited.

Recommendations For versions prior to 10.0.9, update to version 10.0.9 or later to resolve the issue. As a temporary workaround, consider restricting access to the /tmp directory to minimize the risk of exploitation.

Fix

LPE

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2015-5191

MGASA-2017-0354

OPENSUSE-SU-2024:10475-1

SUSE-SU-2017:0701-1

SUSE-SU-2017:0702-1

SUSE-SU-2017:0705-1

SUSE-SU-2017_0701-1

SUSE-SU-2017_0702-1

SUSE-SU-2017_0705-1

Affected Products

Suse

Vmware Tools

References · 42

• https://advisories.mageia.org/MGASA-2017-0354.html · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2017:0702-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-5191 · Security Note
• https://osv.dev/vulnerability/CVE-2015-5191 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2017-0354 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2017:0701-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2015-5191 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2015-5191 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-5191 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-5191 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/3QIKOPGHT5CTPEKNYZDCSQ6O5CAOJHBO · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10475-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-5191 · Vendor Advisory
• https://vmware.com/security/advisories/VMSA-2017-0013.html · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2017:0705-1 · Vendor Advisory