CVE-2025-22247

VMware Tools contains an insecure file handling vulnerability. A malicious actor with non-administrative privileges on a guest VM may tamper the local files to trigger insecure file operations within that VM.

For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section.

The Open Virtual Machine Tools are the open source implementation of the VMware Tools. They are a set of guest operating system virtualization components that enhance performance and user experience of virtual machines.

Security Fix(es):

• open-vm-tools:A malicious actor with non-administrative privileges on a guest virtual machine (VM) may tamper with the local files to trigger insecure file operations within that VM. (CVE-2025-22247)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The Open Virtual Machine Tools are the open source implementation of the VMware Tools. They are a set of guest operating system virtualization components that enhance performance and user experience of virtual machines.

Security Fix(es):

• open-vm-tools:A malicious actor with non-administrative privileges on a guest virtual machine (VM) may tamper with the local files to trigger insecure file operations within that VM. (CVE-2025-22247)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The Open Virtual Machine Tools are the open source implementation of the VMware Tools. They are a set of guest operating system virtualization components that enhance performance and user experience of virtual machines.

Security Fix(es):

• open-vm-tools:A malicious actor with non-administrative privileges on a guest virtual machine (VM) may tamper with the local files to trigger insecure file operations within that VM. (CVE-2025-22247)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

VMware Tools contains an insecure file handling vulnerability. A malicious actor with non-administrative privileges on a guest VM may tamper the local files to trigger insecure file operations within that VM.

VMware Tools contains an insecure file handling vulnerability. A malicious actor with non-administrative privileges on a guest VM may tamper the local files to trigger insecure file operations within that VM.

• CVE-2025-22247: prevent usage of illegal characters in user names and file paths

VMware Tools contains an insecure file handling vulnerability. A malicious actor with non-administrative privileges on a guest VM may tamper the local files to trigger insecure file operations within that VM.

VMware Tools contains an insecure file handling vulnerability. A malicious actor with non-administrative privileges on a guest VM may tamper the local files to trigger insecure file operations within that VM. (CVE-2025-22247)

These are all security issues fixed in the libvmtools-devel-12.5.2-1.1 package on the GA media of openSUSE Tumbleweed.

This update for open-vm-tools fixes the following issues:

Update to 12.5.2:

Security fixes:

• CVE-2025-22247: Fixed Insecure file handling (bsc#1243106)

Other fixes:

• Fixed GCC 15 compile time error (bsc#1241938)
• Fix building with containerd 1.7.25+ (bsc#1237147)

Full changelog:

https://github.com/vmware/open-vm-tools/blob/stable-12.5.2/ReleaseNotes.md https://github.com/vmware/open-vm-tools/blob/stable-12.5.2/open-vm-tools/ChangeLog

This update for open-vm-tools fixes the following issues:

Update to 12.5.2:

Security fixes:

• CVE-2025-22247: Fixed Insecure file handling (bsc#1243106)

Other fixes:

• Fixed GCC 15 compile time error (bsc#1241938)
• Fixed building with containerd 1.7.25+ (bsc#1237147)
• Ensure vmtoolsd.service and vgauthd.service are set to enabled by default (bsc#1237180)

Full changelog:

https://github.com/vmware/open-vm-tools/blob/stable-12.5.2/ReleaseNotes.md https://github.com/vmware/open-vm-tools/blob/stable-12.5.2/open-vm-tools/ChangeLog

This update for open-vm-tools fixes the following issues:

Update to 12.5.2:

Security fixes:

• CVE-2025-22247: Fixed Insecure file handling (bsc#1243106)

Other fixes:

• Fixed GCC 15 compile time error (bsc#1241938)
• Fixed building with containerd 1.7.25+ (bsc#1237147)

Full changelog:

https://github.com/vmware/open-vm-tools/blob/stable-12.5.2/ReleaseNotes.md https://github.com/vmware/open-vm-tools/blob/stable-12.5.2/open-vm-tools/ChangeLog

This update for open-vm-tools fixes the following issues:

Update to 12.5.2:

Security fixes:

• CVE-2025-22247: Fixed Insecure file handling (bsc#1243106)

Other fixes:

• Fixed GCC 15 compile time error (bsc#1241938)
• Fix building with containerd 1.7.25+ (bsc#1237147)

Full changelog:

https://github.com/vmware/open-vm-tools/blob/stable-12.5.2/ReleaseNotes.md https://github.com/vmware/open-vm-tools/blob/stable-12.5.2/open-vm-tools/ChangeLog

This update for open-vm-tools fixes the following issues:

• Updated to 12.5.2:

  • CVE-2025-22247: Fixed insecure file handling (bsc#1243106)

• Fixed gcc15 compile time error (bsc#1241938)

This update for open-vm-tools fixes the following issues:

• Updated to 12.5.2:
  • CVE-2025-22247: Fixed Insecure file handling (bsc#1243106)

It was discovered that Open VM Tools incorrectly handled certain file operations. An attacker in a guest could use this issue to perform insecure file operations and possibly elevate privileges in the guest.

USN-7508-1 fixed a vulnerability in Open VM Tools. This update provides the corresponding update for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS

Original advisory details:

It was discovered that Open VM Tools incorrectly handled certain file operations. An attacker in a guest could use this issue to perform insecure file operations and possibly elevate privileges in the guest.