Security update for open-vm-tools SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2022:2935-1 Final 1 1 2022-08-29T12:24:26Z current 2022-08-29T12:24:26Z 2022-08-29T12:24:26Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for open-vm-tools This update for open-vm-tools fixes the following issues: - Updated to version 12.1.0 (build 20219665) (bsc#1202733): - CVE-2022-31676: Fixed an issue that could allow unprivileged users inside a virtual machine to escalate privileges (bsc#1202657). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2022-2935,SUSE-OpenStack-Cloud-9-2022-2935,SUSE-OpenStack-Cloud-Crowbar-9-2022-2935,SUSE-SLE-SAP-12-SP4-2022-2935,SUSE-SLE-SERVER-12-SP4-LTSS-2022-2935,SUSE-SLE-SERVER-12-SP5-2022-2935 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2022/suse-su-20222935-1/ Link for SUSE-SU-2022:2935-1 https://lists.suse.com/pipermail/sle-security-updates/2022-August/012008.html E-Mail link for SUSE-SU-2022:2935-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1202657 SUSE Bug 1202657 https://bugzilla.suse.com/1202733 SUSE Bug 1202733 https://www.suse.com/security/cve/CVE-2022-31676/ SUSE CVE CVE-2022-31676 page SUSE Linux Enterprise Server 12 SP4-LTSS SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server for SAP Applications 12 SP4 SUSE Linux Enterprise Server for SAP Applications 12 SP5 SUSE OpenStack Cloud 9 SUSE OpenStack Cloud Crowbar 9 libvmtools-devel-12.1.0-4.45.1 libvmtools0-12.1.0-4.45.1 open-vm-tools-12.1.0-4.45.1 open-vm-tools-desktop-12.1.0-4.45.1 open-vm-tools-salt-minion-12.1.0-4.45.1 open-vm-tools-sdmp-12.1.0-4.45.1 libvmtools0-12.1.0-4.45.1 as a component of SUSE Linux Enterprise Server 12 SP4-LTSS open-vm-tools-12.1.0-4.45.1 as a component of SUSE Linux Enterprise Server 12 SP4-LTSS open-vm-tools-desktop-12.1.0-4.45.1 as a component of SUSE Linux Enterprise Server 12 SP4-LTSS libvmtools0-12.1.0-4.45.1 as a component of SUSE Linux Enterprise Server 12 SP5 open-vm-tools-12.1.0-4.45.1 as a component of SUSE Linux Enterprise Server 12 SP5 open-vm-tools-desktop-12.1.0-4.45.1 as a component of SUSE Linux Enterprise Server 12 SP5 open-vm-tools-sdmp-12.1.0-4.45.1 as a component of SUSE Linux Enterprise Server 12 SP5 libvmtools0-12.1.0-4.45.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 open-vm-tools-12.1.0-4.45.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 open-vm-tools-desktop-12.1.0-4.45.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 libvmtools0-12.1.0-4.45.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 open-vm-tools-12.1.0-4.45.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 open-vm-tools-desktop-12.1.0-4.45.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 open-vm-tools-sdmp-12.1.0-4.45.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 libvmtools0-12.1.0-4.45.1 as a component of SUSE OpenStack Cloud 9 open-vm-tools-12.1.0-4.45.1 as a component of SUSE OpenStack Cloud 9 open-vm-tools-desktop-12.1.0-4.45.1 as a component of SUSE OpenStack Cloud 9 libvmtools0-12.1.0-4.45.1 as a component of SUSE OpenStack Cloud Crowbar 9 open-vm-tools-12.1.0-4.45.1 as a component of SUSE OpenStack Cloud Crowbar 9 open-vm-tools-desktop-12.1.0-4.45.1 as a component of SUSE OpenStack Cloud Crowbar 9 VMware Tools (12.0.0, 11.x.y and 10.x.y) contains a local privilege escalation vulnerability. A malicious actor with local non-administrative access to the Guest OS can escalate privileges as a root user in the virtual machine. CVE-2022-31676 SUSE Linux Enterprise Server 12 SP4-LTSS:libvmtools0-12.1.0-4.45.1 SUSE Linux Enterprise Server 12 SP4-LTSS:open-vm-tools-12.1.0-4.45.1 SUSE Linux Enterprise Server 12 SP4-LTSS:open-vm-tools-desktop-12.1.0-4.45.1 SUSE Linux Enterprise Server 12 SP5:libvmtools0-12.1.0-4.45.1 SUSE Linux Enterprise Server 12 SP5:open-vm-tools-12.1.0-4.45.1 SUSE Linux Enterprise Server 12 SP5:open-vm-tools-desktop-12.1.0-4.45.1 SUSE Linux Enterprise Server 12 SP5:open-vm-tools-sdmp-12.1.0-4.45.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libvmtools0-12.1.0-4.45.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:open-vm-tools-12.1.0-4.45.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:open-vm-tools-desktop-12.1.0-4.45.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libvmtools0-12.1.0-4.45.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:open-vm-tools-12.1.0-4.45.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:open-vm-tools-desktop-12.1.0-4.45.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:open-vm-tools-sdmp-12.1.0-4.45.1 SUSE OpenStack Cloud 9:libvmtools0-12.1.0-4.45.1 SUSE OpenStack Cloud 9:open-vm-tools-12.1.0-4.45.1 SUSE OpenStack Cloud 9:open-vm-tools-desktop-12.1.0-4.45.1 SUSE OpenStack Cloud Crowbar 9:libvmtools0-12.1.0-4.45.1 SUSE OpenStack Cloud Crowbar 9:open-vm-tools-12.1.0-4.45.1 SUSE OpenStack Cloud Crowbar 9:open-vm-tools-desktop-12.1.0-4.45.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20222935-1/ https://www.suse.com/security/cve/CVE-2022-31676.html CVE-2022-31676 https://bugzilla.suse.com/1202657 SUSE Bug 1202657 https://bugzilla.suse.com/1202733 SUSE Bug 1202733 https://bugzilla.suse.com/1202834 SUSE Bug 1202834 https://bugzilla.suse.com/1202995 SUSE Bug 1202995 https://bugzilla.suse.com/1204044 SUSE Bug 1204044 https://bugzilla.suse.com/1205471 SUSE Bug 1205471