VMware Tools prior to 10.0.9 contains multiple file system races in libDeployPkg, related to the use of hard-coded paths under /tmp. Successful exploitation of this issue may result in a local privilege escalation. CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_1618 advisory.

    This advisory aggregates security fixes for the open-vm-tools SRPM in CIQ LTS 9.2. It addresses 3 CVEs:
    CVE-2023-20900, CVE-2023-20867, CVE-2015-5191.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0128 advisory.

    This advisory aggregates security fixes for the open-vm-tools SRPM in CIQ LTS 8.6. It addresses 6 CVEs:
    CVE-2023-34059, CVE-2023-20900, CVE-2022-31676, CVE-2023-20867, CVE-2015-5191, and 1 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of F5 Networks BIG-IP installed on the remote host is prior to 14.1.5 / 15.1.5 / 16.0.0. It is, therefore, affected by a vulnerability as referenced in the K84583382 advisory.

  - VMware Tools prior to 10.0.9 contains multiple file system races in libDeployPkg, related to the use of     hard-coded paths under /tmp. Successful exploitation of this issue may result in a local privilege     escalation. CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H (CVE-2015-5191)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Fix /tmp race conditions in libDeployPkg (CVE-2015-5191).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for open-vm-tools to 10.1.0 stable brings features, fixes bugs and security issues :

  - New vmware-namespace-cmd command line utility

  - GTK3 support

  - Common Agent Framework (CAF)

  - Guest authentication with xmlsec1

  - Sub-command to push updated network information to the     host on demand

  - Fix for quiesced snapshot failure leaving guest file     system quiesced (bsc#1006796)

  - Fix for CVE-2015-5191 (bsc#1007600)

  - Report SLES for SAP 12 guest OS as SLES 12 (bsc#1013496)

  - Add udev rule to increase VMware virtual disk timeout     values (bsc#994598) 

  - Fix vmtoolsd init script to run vmtoolsd in background     (bsc#971031)

This update was imported from the SUSE:SLE-12-SP2:Update update project.

This update for open-vm-tools to 10.1.0 stable brings features, fixes bugs and security issues :

  - New vmware-namespace-cmd command line utility

  - GTK3 support

  - Common Agent Framework (CAF)

  - Guest authentication with xmlsec1

  - Sub-command to push updated network information to the     host on demand

  - Fix for quiesced snapshot failure leaving guest file     system quiesced (bsc#1006796)

  - Fix for CVE-2015-5191 (bsc#1007600)

  - Report SLES for SAP 12 guest OS as SLES 12 (bsc#1013496)

  - Add udev rule to increase VMware virtual disk timeout     values (bsc#994598)

  - Fix vmtoolsd init script to run vmtoolsd in background     (bsc#971031)

  - Fix copy-n-paste and drag-n-drop regressions     (bsc#978424)

  - Add new vmblock-fuse.service

  - Fix a suspend with systemd issue (bsc#913727)

  - ESXi Serviceability

  - GuestInfo Enhancements

  - Compatibility with all supported versions of VMware     vSphere, VMware Workstation 12.0 and VMware Fusion 8.0.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for open-vm-tools to 10.1.0 stable brings features, fixes bugs and security issues :

  - New vmware-namespace-cmd command line utility

  - GTK3 support

  - Common Agent Framework (CAF)

  - Guest authentication with xmlsec1

  - Sub-command to push updated network information to the     host on demand

  - Fix for quiesced snapshot failure leaving guest file     system quiesced (bsc#1006796)

  - Fix for CVE-2015-5191 (bsc#1007600)

  - Report SLES for SAP 12 guest OS as SLES 12 (bsc#1013496)

  - Add udev rule to increase VMware virtual disk timeout     values (bsc#994598)

  - Fix vmtoolsd init script to run vmtoolsd in background     (bsc#971031)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for open-vm-tools to 10.1.0 stable brings features, fixes bugs and security issues :

  - New vmware-namespace-cmd command line utility

  - GTK3 support

  - Common Agent Framework (CAF)

  - Guest authentication with xmlsec1

  - Sub-command to push updated network information to the     host on demand

  - Fix for quiesced snapshot failure leaving guest file     system quiesced (bsc#1006796)

  - Fix for CVE-2015-5191 (bsc#1007600)

  - Report SLES for SAP 12 guest OS as SLES 12 (bsc#1013496)

  - Add udev rule to increase VMware virtual disk timeout     values (bsc#994598)

  - Fix vmtoolsd init script to run vmtoolsd in background     (bsc#971031)

  - Fix copy-n-paste and drag-n-drop regressions     (bsc#978424)

  - Add new vmblock-fuse.service

  - Fix a suspend with systemd issue (bsc#913727)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for open-vm-tools fixes the following issues :

  - Updated to 10.1.0 stable release (boo#1011057)

  + vmware-namespace-cmd command line utility.

  + gtk3 support

  + Common Agent Framework (CAF)

  + guest authentication with xmlsec1

  + FreeBSD support

  + sub-command to push updated network information to the     host on demand

  + udev rules for configuring SCSI timeouts in the guest

  + fixes for Ubuntu 16.10

  + Fix for quiesced snapshot failure leaving guest file     system quiesced (boo#1006796)

  + Fix for CVE-2015-5191 (boo#1007600)

  - Report SLES12-SAP guest OS as SLES12 (boo#1013496)

  - Remove building KMP modules. No longer needed or wanted     for current releases. User space tool vmhgfs-fuse has     replaced the need for vmhgfs kernel module.

  - Add udev rule to increase VMware virtual disk timeout     values (boo#994598) 

  - Fix vmtoolsd init script to run vmtoolsd in background.
    (boo#971031)

  + fix originally done in SLE-11-SP4 code base by     tcech@suse.cz

  - Added patches for GCC 6 build failure (boo#985110)

  - Update to 10.0.7-gtk3 stable branch

  + add support for gtk3, needed by the dndcp and     resolutionset plugins

  + remove files generated by autoreconf

  + a few minor build fixes

  - Update fixes copy-n-paste and drag-n-drop regressions     (boo#978424)

  - Added new vmblock-fuse.service

  - Update to 10.0.7 stable branch

  + Added namespace command line utility     'vmware-namespace-cmd'.

  - Compile without gtkmm support for SLES12 based     environments (which do not provide gtkmm2.4)

  - Update to 10.0.5 stable branch

  + [vgauth] fix timestamp check

  + [libresolutionSet.so] Add an error handler to X11     resolutionSet

  + [vmci.ko] Kill tasklet when unloading vmci module

  + [libvmbackup.so] Quiesced snapshots Skip freezing autofs     mounts.

  + [vmhgfs.ko] make vmhgfs compatible with Linux kernel 4.2 

  - This update also addresses a suspend with systemd issue     (boo#913727)

ID	Name	Product	Family	Type	Severity
364600	Rocky Linux 9.2 [CIQ] Security Update: open-vm-tools / open-vm-tools-desktop / open-vm-tools-devel / etc Multiple Vulnerabilities (ciqsa-2026_1618)	Nessus	Rocky Linux Local Security Checks	Local	high
354336	Rocky Linux 8.6 [CIQ] Security Update: open-vm-tools / open-vm-tools-debuginfo / open-vm-tools-debugsource / etc Multiple Vulnerabilities (ciqsa-2026_0128)	Nessus	Rocky Linux Local Security Checks	Local	high
158316	F5 Networks BIG-IP : VMware Tools vulnerability (K84583382)	Nessus	F5 Networks Local Security Checks	Local	medium
102185	Fedora 25 : open-vm-tools (2017-4b4154d6f6)	Nessus	Fedora Local Security Checks	Local	medium
101986	Fedora 26 : open-vm-tools (2017-08ec8b6dc4)	Nessus	Fedora Local Security Checks	Local	medium
99019	openSUSE Security Update : open-vm-tools (openSUSE-2017-385)	Nessus	SuSE Local Security Checks	Local	medium
97777	SUSE SLES11 Security Update : open-vm-tools (SUSE-SU-2017:0705-1)	Nessus	SuSE Local Security Checks	Local	medium
97775	SUSE SLED12 / SLES12 Security Update : open-vm-tools (SUSE-SU-2017:0702-1)	Nessus	SuSE Local Security Checks	Local	medium
97774	SUSE SLED12 / SLES12 Security Update : open-vm-tools (SUSE-SU-2017:0701-1)	Nessus	SuSE Local Security Checks	Local	medium
97285	openSUSE Security Update : open-vm-tools (openSUSE-2017-276)	Nessus	SuSE Local Security Checks	Local	medium

Detections

Analytics

CVE-2015-5191

medium

Tenable Plugins

high

high

medium

medium

medium

medium

medium

medium

medium

medium