Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2015-5191: VMware Tools before 10.0.9 can let local users gain admin

CVE-2015-5191 · published 9 years ago

Summary

Versions of VMware Tools older than 10.0.9 use fixed temporary folders that can be tricked into running malicious code. This flaw could let someone with access to the computer elevate their rights to full administrator level. Install the latest VMware Tools version (10.0.9 or newer) and restrict local account privileges to mitigate the risk.

What to do

Update debian open-vm-tools to version 2:10.1.5-5055683-5.

Affected software

Ecosystem	Vendor	Product	Affected versions
Debian:11	debian	open-vm-tools	< 2:10.1.5-5055683-5 Fix: upgrade to 2:10.1.5-5055683-5
Debian:12	debian	open-vm-tools	< 2:10.1.5-5055683-5 Fix: upgrade to 2:10.1.5-5055683-5
Debian:13	debian	open-vm-tools	< 2:10.1.5-5055683-5 Fix: upgrade to 2:10.1.5-5055683-5
–	vmware	tools	<= 10.0.8 `cpe:2.3:a:vmware:tools::::::::`

Original advisory text

VMware Tools prior to 10.0.9 contains multiple file system races in libDeployPkg, related to the use of hard-coded paths under /tmp. Successful exploitation of this issue may result in a local priv...

References

https://security-tracker.debian.org/tracker/CVE-2015-5191 Vendor Advisory
http://www.securityfocus.com/bid/100011 Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1039013 Third Party Advisory VDB Entry
https://www.vmware.com/security/advisories/VMSA-2017-0013.html Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

6.7 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-362Race Condition

Timeline

Published28 Jul 2017

Updated4 Nov 2026

First seen26 Aug 2026

Sources

DEBIAN-CVE-2015-5191 · OSV

CVE-2015-5191 · NVD

Track software like this

Free during beta