This bug was fixed in the package open-vm-tools -
2:12.5.0-1~ubuntu0.24.04.1
---------------
open-vm-tools (2:12.5.0-1~ubuntu0.24.04.1) noble; urgency=medium
* Backport recent open-vm-tools release v12.5.0 (LP: #2122116)
- For changes included in this update, see:
https://github.com/vmware/open-vm-tools/blob/stable-12.5.0/ReleaseNotes.md
open-vm-tools (2:12.5.0-1ubuntu0.1) plucky-security; urgency=medium
* SECURITY UPDATE: insecure file handling vulnerability
- debian/patches/CVE-2025-22247.patch: properly check symlinks and path
traversal chars in open-vm-tools/vgauth/common/VGAuthUtil.c,
open-vm-tools/vgauth/common/VGAuthUtil.h,
open-vm-tools/vgauth/common/prefs.h,
open-vm-tools/vgauth/common/usercheck.c,
open-vm-tools/vgauth/serviceImpl/alias.c,
open-vm-tools/vgauth/serviceImpl/service.c,
open-vm-tools/vgauth/serviceImpl/serviceInt.h.
- CVE-2025-22247
open-vm-tools (2:12.5.0-1) unstable; urgency=medium
* Update to 12.5.0, full release notes can be found at
https://github.com/vmware/open-vm-tools/blob/stable-12.5.0/ReleaseNotes.md
- d/copyright: update to 12.5.0
- d/copyright: add missing path element to fix superfluous-file-pattern
- d/copyright: bsd files gone since 10.2.5
- d/*.lintian-overrides: fix paths
-- Renan Rodrigo <[email protected]> Fri, 05 Sep 2025
10:01:22 -0300
** Changed in: open-vm-tools (Ubuntu Noble)
Status: Fix Committed => Fix Released
** CVE added: https://cve.org/CVERecord?id=CVE-2025-22247
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2122116
Title:
Backport open-vm-tools version 2:12.5.0-1 to noble
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/open-vm-tools/+bug/2122116/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
