Early Access — Mondoo Vulnerability Intelligence is currently in preview.

SUSE-SU-2023:4227-1

UNKNOWN

Security update for open-vm-tools

Published Oct 27, 2023

Modified 2 years ago

Fix available

Details

This update for open-vm-tools fixes the following issues:

CVE-2023-34058: Fixed a SAML token signature bypass issue (bsc#1216432).
CVE-2023-34059: Fixed a privilege escalation issue through vmware-user-suid-wrapper (bsc#1216433).

Affected Packages

SUSE:Enterprise Storage 7.1libvmtools-devel

Fixed in:

12.3.0-150300.43.1

SUSE:Enterprise Storage 7.1libvmtools0

Fixed in:

12.3.0-150300.43.1

SUSE:Enterprise Storage 7.1open-vm-tools

Fixed in:

12.3.0-150300.43.1

SUSE:Enterprise Storage 7.1open-vm-tools-containerinfo

Fixed in:

12.3.0-150300.43.1

SUSE:Enterprise Storage 7.1open-vm-tools-desktop

Fixed in:

12.3.0-150300.43.1

SUSE:Enterprise Storage 7.1open-vm-tools-salt-minion

Fixed in:

12.3.0-150300.43.1

SUSE:Enterprise Storage 7.1open-vm-tools-sdmp

Fixed in:

12.3.0-150300.43.1

SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOSlibvmtools-devel

Fixed in:

12.3.0-150300.43.1

SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOSlibvmtools0

Fixed in:

12.3.0-150300.43.1

SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOSopen-vm-tools

Fixed in:

12.3.0-150300.43.1

SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOSopen-vm-tools-containerinfo

Fixed in:

12.3.0-150300.43.1

SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOSopen-vm-tools-desktop

Fixed in:

12.3.0-150300.43.1

SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOSopen-vm-tools-salt-minion

Fixed in:

12.3.0-150300.43.1

SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOSopen-vm-tools-sdmp

Fixed in:

12.3.0-150300.43.1

SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSSlibvmtools-devel

Fixed in:

12.3.0-150300.43.1

SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSSlibvmtools0

Fixed in:

12.3.0-150300.43.1

SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSSopen-vm-tools

Fixed in:

12.3.0-150300.43.1

SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSSopen-vm-tools-containerinfo

Fixed in:

12.3.0-150300.43.1

SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSSopen-vm-tools-desktop

Fixed in:

12.3.0-150300.43.1

SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSSopen-vm-tools-sdmp

Fixed in:

12.3.0-150300.43.1

SUSE:Linux Enterprise Micro 5.1libvmtools0

Fixed in:

12.3.0-150300.43.1

SUSE:Linux Enterprise Micro 5.1open-vm-tools

Fixed in:

12.3.0-150300.43.1

SUSE:Linux Enterprise Micro 5.2libvmtools0

Fixed in:

12.3.0-150300.43.1

SUSE:Linux Enterprise Micro 5.2open-vm-tools

Fixed in:

12.3.0-150300.43.1

SUSE:Linux Enterprise Micro 5.3libvmtools0

Fixed in:

12.3.0-150300.43.1

SUSE:Linux Enterprise Micro 5.3open-vm-tools

Fixed in:

12.3.0-150300.43.1

SUSE:Linux Enterprise Micro 5.4libvmtools0

Fixed in:

12.3.0-150300.43.1

SUSE:Linux Enterprise Micro 5.4open-vm-tools

Fixed in:

12.3.0-150300.43.1

SUSE:Linux Enterprise Micro 5.5libvmtools0

Fixed in:

12.3.0-150300.43.1

SUSE:Linux Enterprise Micro 5.5open-vm-tools

Fixed in:

12.3.0-150300.43.1

SUSE:Linux Enterprise Module for Basesystem 15 SP4libvmtools-devel

Fixed in:

12.3.0-150300.43.1

SUSE:Linux Enterprise Module for Basesystem 15 SP4libvmtools0

Fixed in:

12.3.0-150300.43.1

SUSE:Linux Enterprise Module for Basesystem 15 SP4open-vm-tools

Fixed in:

12.3.0-150300.43.1

SUSE:Linux Enterprise Module for Basesystem 15 SP4open-vm-tools-containerinfo

Fixed in:

12.3.0-150300.43.1

SUSE:Linux Enterprise Module for Basesystem 15 SP4open-vm-tools-salt-minion

Fixed in:

12.3.0-150300.43.1

SUSE:Linux Enterprise Module for Basesystem 15 SP4open-vm-tools-sdmp

Fixed in:

12.3.0-150300.43.1

SUSE:Linux Enterprise Module for Basesystem 15 SP5libvmtools-devel

Fixed in:

12.3.0-150300.43.1

SUSE:Linux Enterprise Module for Basesystem 15 SP5libvmtools0

Fixed in:

12.3.0-150300.43.1

SUSE:Linux Enterprise Module for Basesystem 15 SP5open-vm-tools

Fixed in:

12.3.0-150300.43.1

SUSE:Linux Enterprise Module for Basesystem 15 SP5open-vm-tools-containerinfo

Fixed in:

12.3.0-150300.43.1

SUSE:Linux Enterprise Module for Basesystem 15 SP5open-vm-tools-salt-minion

Fixed in:

12.3.0-150300.43.1

SUSE:Linux Enterprise Module for Basesystem 15 SP5open-vm-tools-sdmp

Fixed in:

12.3.0-150300.43.1

SUSE:Linux Enterprise Module for Desktop Applications 15 SP4open-vm-tools

Fixed in:

12.3.0-150300.43.1

SUSE:Linux Enterprise Module for Desktop Applications 15 SP4open-vm-tools-desktop

Fixed in:

12.3.0-150300.43.1

SUSE:Linux Enterprise Module for Desktop Applications 15 SP5open-vm-tools

Fixed in:

12.3.0-150300.43.1

SUSE:Linux Enterprise Module for Desktop Applications 15 SP5open-vm-tools-desktop

Fixed in:

12.3.0-150300.43.1

SUSE:Linux Enterprise Server 15 SP3-LTSSlibvmtools-devel

Fixed in:

12.3.0-150300.43.1

SUSE:Linux Enterprise Server 15 SP3-LTSSlibvmtools0

Fixed in:

12.3.0-150300.43.1

SUSE:Linux Enterprise Server 15 SP3-LTSSopen-vm-tools

Fixed in:

12.3.0-150300.43.1

SUSE:Linux Enterprise Server 15 SP3-LTSSopen-vm-tools-containerinfo

Fixed in:

12.3.0-150300.43.1

SUSE:Linux Enterprise Server 15 SP3-LTSSopen-vm-tools-desktop

Fixed in:

12.3.0-150300.43.1

SUSE:Linux Enterprise Server 15 SP3-LTSSopen-vm-tools-salt-minion

Fixed in:

12.3.0-150300.43.1

SUSE:Linux Enterprise Server 15 SP3-LTSSopen-vm-tools-sdmp

Fixed in:

12.3.0-150300.43.1

SUSE:Linux Enterprise Server for SAP Applications 15 SP3libvmtools-devel

Fixed in:

12.3.0-150300.43.1

SUSE:Linux Enterprise Server for SAP Applications 15 SP3libvmtools0

Fixed in:

12.3.0-150300.43.1

SUSE:Linux Enterprise Server for SAP Applications 15 SP3open-vm-tools

Fixed in:

12.3.0-150300.43.1

SUSE:Linux Enterprise Server for SAP Applications 15 SP3open-vm-tools-containerinfo

Fixed in:

12.3.0-150300.43.1

SUSE:Linux Enterprise Server for SAP Applications 15 SP3open-vm-tools-desktop

Fixed in:

12.3.0-150300.43.1

SUSE:Linux Enterprise Server for SAP Applications 15 SP3open-vm-tools-sdmp

Fixed in:

12.3.0-150300.43.1

SUSE:Manager Proxy 4.2libvmtools-devel

Fixed in:

12.3.0-150300.43.1

SUSE:Manager Proxy 4.2libvmtools0

Fixed in:

12.3.0-150300.43.1

SUSE:Manager Proxy 4.2open-vm-tools

Fixed in:

12.3.0-150300.43.1

SUSE:Manager Proxy 4.2open-vm-tools-sdmp

Fixed in:

12.3.0-150300.43.1

SUSE:Manager Server 4.2libvmtools-devel

Fixed in:

12.3.0-150300.43.1

SUSE:Manager Server 4.2libvmtools0

Fixed in:

12.3.0-150300.43.1

SUSE:Manager Server 4.2open-vm-tools

Fixed in:

12.3.0-150300.43.1

SUSE:Manager Server 4.2open-vm-tools-sdmp

Fixed in:

12.3.0-150300.43.1

openSUSE:Leap 15.4libvmtools-devel

Fixed in:

12.3.0-150300.43.1

openSUSE:Leap 15.4libvmtools0

Fixed in:

12.3.0-150300.43.1

openSUSE:Leap 15.4open-vm-tools

Fixed in:

12.3.0-150300.43.1

openSUSE:Leap 15.4open-vm-tools-containerinfo

Fixed in:

12.3.0-150300.43.1

openSUSE:Leap 15.4open-vm-tools-desktop

Fixed in:

12.3.0-150300.43.1

openSUSE:Leap 15.4open-vm-tools-salt-minion

Fixed in:

12.3.0-150300.43.1

openSUSE:Leap 15.4open-vm-tools-sdmp

Fixed in:

12.3.0-150300.43.1

openSUSE:Leap 15.5libvmtools-devel

Fixed in:

12.3.0-150300.43.1

openSUSE:Leap 15.5libvmtools0

Fixed in:

12.3.0-150300.43.1

openSUSE:Leap 15.5open-vm-tools

Fixed in:

12.3.0-150300.43.1

openSUSE:Leap 15.5open-vm-tools-containerinfo

Fixed in:

12.3.0-150300.43.1

openSUSE:Leap 15.5open-vm-tools-desktop

Fixed in:

12.3.0-150300.43.1

openSUSE:Leap 15.5open-vm-tools-salt-minion

Fixed in:

12.3.0-150300.43.1

openSUSE:Leap 15.5open-vm-tools-sdmp

Fixed in:

12.3.0-150300.43.1

openSUSE:Leap Micro 5.3libvmtools0

Fixed in:

12.3.0-150300.43.1

openSUSE:Leap Micro 5.3open-vm-tools

Fixed in:

12.3.0-150300.43.1

openSUSE:Leap Micro 5.4libvmtools0

Fixed in:

12.3.0-150300.43.1

openSUSE:Leap Micro 5.4open-vm-tools

Fixed in:

12.3.0-150300.43.1

References

REPORThttps://bugzilla.suse.com/1216432 REPORThttps://bugzilla.suse.com/1216433 WEBhttps://www.suse.com/security/cve/CVE-2023-34058 WEBhttps://www.suse.com/security/cve/CVE-2023-34059 ADVISORYhttps://www.suse.com/support/update/announcement/2023/suse-su-20234227-1/

Upstream

CVE-2023-34058 CVE-2023-34059

Related

CVE-2023-34058 CVE-2023-34059

Timeline

PublishedOct 27, 2023

ModifiedOct 27, 2023

SUSE-SU-2023:4227-1 | Mondoo Vulnerability Intelligence