Security update for open-vm-tools SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2017:0509-1 Final 1 1 2017-02-18T12:01:54Z current 2017-02-18T12:01:54Z 2017-02-18T12:01:54Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for open-vm-tools This update for open-vm-tools fixes the following issues: - Updated to 10.1.0 stable release (boo#1011057) + vmware-namespace-cmd command line utility. + gtk3 support + Common Agent Framework (CAF) + guest authentication with xmlsec1 + FreeBSD support + sub-command to push updated network information to the host on demand + udev rules for configuring SCSI timeouts in the guest + fixes for Ubuntu 16.10 + Fix for quiesced snapshot failure leaving guest file system quiesced (boo#1006796) + Fix for CVE-2015-5191 (boo#1007600) - Report SLES12-SAP guest OS as SLES12 (boo#1013496) - Remove building KMP modules. No longer needed or wanted for current releases. User space tool vmhgfs-fuse has replaced the need for vmhgfs kernel module. - Add udev rule to increase VMware virtual disk timeout values (boo#994598) - Fix vmtoolsd init script to run vmtoolsd in background. (boo#971031) + fix originally done in SLE-11-SP4 code base by tcech@suse.cz - Added patches for GCC 6 build failure (boo#985110) - Update to 10.0.7-gtk3 stable branch + add support for gtk3, needed by the dndcp and resolutionset plugins + remove files generated by autoreconf + a few minor build fixes - Update fixes copy-n-paste and drag-n-drop regressions (boo#978424) - Added new vmblock-fuse.service - Update to 10.0.7 stable branch + Added namespace command line utility 'vmware-namespace-cmd'. - Compile without gtkmm support for SLES12 based environments (which do not provide gtkmm2.4) - Update to 10.0.5 stable branch + [vgauth] fix timestamp check + [libresolutionSet.so] Add an error handler to X11 resolutionSet + [vmci.ko] Kill tasklet when unloading vmci module + [libvmbackup.so] Quiesced snapshots Skip freezing autofs mounts. + [vmhgfs.ko] make vmhgfs compatible with Linux kernel 4.2 - This update also addresses a suspend with systemd issue (boo#913727) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/opensuse-updates/2017-02/msg00088.html E-Mail link for openSUSE-SU-2017:0509-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings openSUSE Leap 42.1 libvmtools-devel-10.1.0-6.1 libvmtools0-10.1.0-6.1 open-vm-tools-10.1.0-6.1 open-vm-tools-desktop-10.1.0-6.1 libvmtools-devel-10.1.0-6.1 as a component of openSUSE Leap 42.1 libvmtools0-10.1.0-6.1 as a component of openSUSE Leap 42.1 open-vm-tools-10.1.0-6.1 as a component of openSUSE Leap 42.1 open-vm-tools-desktop-10.1.0-6.1 as a component of openSUSE Leap 42.1 VMware Tools prior to 10.0.9 contains multiple file system races in libDeployPkg, related to the use of hard-coded paths under /tmp. Successful exploitation of this issue may result in a local privilege escalation. CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H CVE-2015-5191 openSUSE Leap 42.1:libvmtools-devel-10.1.0-6.1 openSUSE Leap 42.1:libvmtools0-10.1.0-6.1 openSUSE Leap 42.1:open-vm-tools-10.1.0-6.1 openSUSE Leap 42.1:open-vm-tools-desktop-10.1.0-6.1 moderate 6.6 AV:L/AC:M/Au:S/C:C/I:C/A:C Please Install the update. https://lists.opensuse.org/opensuse-updates/2017-02/msg00088.html https://www.suse.com/security/cve/CVE-2015-5191.html CVE-2015-5191 https://bugzilla.suse.com/1007600 SUSE Bug 1007600