CVE-2015-5191
VMware Tools prior to 10.0.9 contains multiple file system races in libDeployPkg, related to the...
VMware Tools prior to 10.0.9 contains multiple file system races in libDeployPkg, related to the use of hard-coded paths under /tmp. Successful exploitation of this issue may result in a local privilege escalation. CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
VMware Tools prior to 10.0.9 contains multiple file system races in libDeployPkg, related to the use of hard-coded paths under /tmp. Successful exploitation of this issue may result in a local privilege escalation. CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
- Record
CVE-2015-5191- CVSS 3.0
- 6.7 Medium
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 3.7 Low
AV:L/AC:H/Au:N/C:P/I:P/A:P - Weakness
- CWE-362
- Updated
- 2026-11-02
CVE List No score
VMware Tools prior to 10.0.9 contains multiple file system races in libDeployPkg, related to the use of hard-coded paths under /tmp. Successful exploitation of this issue may result in a local privilege escalation. CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
- Record
CVE-2015-5191- Updated
- 2026-11-02
EUVDEUVD-2015-5192 No score
VMware Tools prior to 10.0.9 contains multiple file system races in libDeployPkg, related to the use of hard-coded paths under /tmp. Successful exploitation of this issue may result in a local privilege escalation. CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
- Record
EUVD-2015-5192- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4vr2-36wr-v82r
VMware Tools prior to 10.0.9 contains multiple file system races in libDeployPkg, related to the...
VMware Tools prior to 10.0.9 contains multiple file system races in libDeployPkg, related to the use of hard-coded paths under /tmp. Successful exploitation of this issue may result in a local privilege escalation. CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
- Record
GHSA-4vr2-36wr-v82r- CVSS 3.0
- 6.7 Medium
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-362
- Updated
- 2026-11-02
OSV
VMware Tools prior to 10.0.9 contains multiple file system races in libDeployPkg, related to the use of hard-coded paths under /tmp. Successful exploitation of this issue may result in a local privilege escalation. CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
- Record
CVE-2015-5191- CVSS 3.0
- 6.7 Medium
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2015-5191
VMware Tools prior to 10.0.9 contains multiple file system races in libDeployPkg, related to the use of hard-coded paths under /tmp. Successful exploitation of this issue may result in a local privilege escalation. CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
- Record
DEBIAN-CVE-2015-5191- CVSS 3.0
- 6.7 Medium
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 6 moreShow less
OSVUBUNTU-CVE-2015-5191
VMware Tools prior to 10.0.9 contains multiple file system races in libDeployPkg, related to the use of hard-coded paths under /tmp. Successful exploitation of this issue may result in a local privilege escalation. CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
- Record
UBUNTU-CVE-2015-5191- CVSS 3.0
- 6.7 Medium
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2017-0354 No score
Updated open-vm-tools packages fix security vulnerability
It was discovered that open-vm-tools has multiple /tmp race conditions in the libDeployPkg component, allowing an unprivileged local user in a guest to cause a denial of service through file system manipulation, or, possibly, increase privileges (CVE-2015-5191).
- Record
MGASA-2017-0354- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10475-1 No score
libvmtools-devel-10.1.0-1.1 on GA media
These are all security issues fixed in the libvmtools-devel-10.1.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10475-1- Updated
- 2026-11-02
OSVSUSE-SU-2017:0701-1 No score
Security update for open-vm-tools
This update for open-vm-tools to 10.1.0 stable brings features, fixes bugs and security issues:
- New vmware-namespace-cmd command line utility
- GTK3 support
- Common Agent Framework (CAF)
- Guest authentication with xmlsec1
- Sub-command to push updated network information to the host on demand
- Fix for quiesced snapshot failure leaving guest file system quiesced (bsc#1006796)
- Fix for CVE-2015-5191 (bsc#1007600)
- Report SLES for SAP 12 guest OS as SLES 12 (bsc#1013496)
- Add udev rule to increase VMware virtual disk timeout values (bsc#994598)
- Fix vmtoolsd init script to run vmtoolsd in background (bsc#971031)
- Fix copy-n-paste and drag-n-drop regressions (bsc#978424)
- Add new vmblock-fuse.service
- Fix a suspend with systemd issue (bsc#913727)
- Record
SUSE-SU-2017:0701-1- Updated
- 2026-11-02
OSVSUSE-SU-2017:0702-1 No score
Security update for open-vm-tools
This update for open-vm-tools to 10.1.0 stable brings features, fixes bugs and security issues:
- New vmware-namespace-cmd command line utility
- GTK3 support
- Common Agent Framework (CAF)
- Guest authentication with xmlsec1
- Sub-command to push updated network information to the host on demand
- Fix for quiesced snapshot failure leaving guest file system quiesced (bsc#1006796)
- Fix for CVE-2015-5191 (bsc#1007600)
- Report SLES for SAP 12 guest OS as SLES 12 (bsc#1013496)
- Add udev rule to increase VMware virtual disk timeout values (bsc#994598)
- Fix vmtoolsd init script to run vmtoolsd in background (bsc#971031)
- Record
SUSE-SU-2017:0702-1- Updated
- 2026-11-02
OSVSUSE-SU-2017:0705-1 No score
Security update for open-vm-tools
This update for open-vm-tools to 10.1.0 stable brings features, fixes bugs and security issues:
- New vmware-namespace-cmd command line utility
- GTK3 support
- Common Agent Framework (CAF)
- Guest authentication with xmlsec1
- Sub-command to push updated network information to the host on demand
- Fix for quiesced snapshot failure leaving guest file system quiesced (bsc#1006796)
- Fix for CVE-2015-5191 (bsc#1007600)
- Report SLES for SAP 12 guest OS as SLES 12 (bsc#1013496)
- Add udev rule to increase VMware virtual disk timeout values (bsc#994598)
- Fix vmtoolsd init script to run vmtoolsd in background (bsc#971031)
- Fix copy-n-paste and drag-n-drop regressions (bsc#978424)
- Add new vmblock-fuse.service
- Fix a suspend with systemd issue (bsc#913727)
- ESXi Serviceability
- GuestInfo Enhancements
- Compatibility with all supported versions of VMware vSphere, VMware Workstation 12.0 and VMware Fusion 8.0.
- Record
SUSE-SU-2017:0705-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
open-vm-toolsDebian:12 |
before 2:10.1.5-5055683-5 | 2:10.1.5-5055683-5 |
open-vm-toolsDebian:13 |
before 2:10.1.5-5055683-5 | 2:10.1.5-5055683-5 |
open-vm-toolsDebian:14 |
before 2:10.1.5-5055683-5 | 2:10.1.5-5055683-5 |
open-vm-toolsMageia:6 |
before 10.1.5-2.1.mga6 | 10.1.5-2.1.mga6 |
open-vm-toolsSUSE:Linux Enterprise Desktop 12 SP1 |
before 10.1.0-5.3.1 | 10.1.0-5.3.1 |
open-vm-toolsSUSE:Linux Enterprise Server 12 SP1 |
before 10.1.0-5.3.1 | 10.1.0-5.3.1 |
open-vm-toolsSUSE:Linux Enterprise Server for SAP Applications 12 SP1 |
before 10.1.0-5.3.1 | 10.1.0-5.3.1 |
open-vm-toolsSUSE:Linux Enterprise Desktop 12 SP2 |
before 10.1.0-8.1 | 10.1.0-8.1 |
open-vm-toolsSUSE:Linux Enterprise Server 12 SP2 |
before 10.1.0-8.1 | 10.1.0-8.1 |
open-vm-toolsSUSE:Linux Enterprise Server for SAP Applications 12 SP2 |
before 10.1.0-8.1 | 10.1.0-8.1 |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
open-vm-toolsSUSE:Linux Enterprise Server 11 SP4 |
before 10.1.0-7.1 | 10.1.0-7.1 |
open-vm-toolsSUSE:Linux Enterprise Server for SAP Applications 11 SP4 |
before 10.1.0-7.1 | 10.1.0-7.1 |
open-vm-toolsUbuntu:16.04:LTS |
before 2:10.2.0-3~ubuntu0.16.04.1, plus listed versions 2:9.10.2-2822639-1ubuntu32:10.0.0-3000743-3ubuntu12:10.0.7-3227872-2ubuntu12:10.0.7-3227872-5ubuntu1~16.04.12:10.0.7-3227872-5ubuntu1~16.04.2 |
2:10.2.0-3~ubuntu0.16.04.1 |
open-vm-toolsopenSUSE:Tumbleweed |
before 10.1.0-1.1 | 10.1.0-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-5191 is a medium vulnerability (CVSS 6.7) in Vmware Tools, published March 15, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.33%, the 26th percentile. Fixed in open-vm-tools 2:10.1.5-5055683-5.
References
securityfocus.com/bid/100011
vmware.com/security/advisories/VMSA-2017-0013.html
securitytracker.com/id/1039013
nvd.nist.gov/vuln/detail/CVE-2015-5191
github.com/advisories/GHSA-4vr2-36wr-v82r
security-tracker.debian.org/tracker/CVE-2015-5191
Show 24 moreShow less
advisories.mageia.org/MGASA-2017-0354.html
bugs.mageia.org/show_bug.cgi?id=20323
lists.fedoraproject.org/archives/list/[email protected]/thread/3QIKOPGHT5CTPEKNYZDCSQ6O5CAOJHBO
suse.com/support/update/announcement/2017/suse-su-20170701-1
bugzilla.suse.com/1006796
ubuntu.com/security/CVE-2015-5191
cve.org/CVERecord?id=CVE-2015-5191