Debian Bug report logs -
#869633
CVE-2015-5191
Reported by: Moritz Muehlenhoff <jmm@debian.org>
Date: Tue, 25 Jul 2017 07:33:02 UTC
Severity: grave
Tags: fixed-upstream, security, upstream
Found in version open-vm-tools/2:10.1.5-5055683-1
Fixed in versions open-vm-tools/2:10.1.5-5055683-5, open-vm-tools/2:10.1.5-5055683-4+deb9u1
Done: Bernd Zeimetz <bzed@debian.org>
Bug is archived. No further changes may be made.
Toggle useless messages
Report forwarded
to debian-bugs-dist@lists.debian.org, team@security.debian.org, secure-testing-team@lists.alioth.debian.org, Bernd Zeimetz <bzed@debian.org>:
Bug#869633; Package src:open-vm-tools.
(Tue, 25 Jul 2017 07:33:04 GMT) (full text, mbox, link).
Acknowledgement sent
to Moritz Muehlenhoff <jmm@debian.org>:
New Bug report received and forwarded. Copy sent to team@security.debian.org, secure-testing-team@lists.alioth.debian.org, Bernd Zeimetz <bzed@debian.org>.
(Tue, 25 Jul 2017 07:33:04 GMT) (full text, mbox, link).
Message #5 received at submit@bugs.debian.org (full text, mbox, reply):
Source: open-vm-tools
Severity: grave
Tags: security
Please see:
http://www.openwall.com/lists/oss-security/2017/07/24/3
Cheers,
Moritz
Marked as found in versions open-vm-tools/2:10.1.5-5055683-1.
Request was from Salvatore Bonaccorso <carnil@debian.org>
to control@bugs.debian.org.
(Tue, 25 Jul 2017 07:42:03 GMT) (full text, mbox, link).
Added tag(s) fixed-upstream and upstream.
Request was from Salvatore Bonaccorso <carnil@debian.org>
to control@bugs.debian.org.
(Tue, 25 Jul 2017 07:42:03 GMT) (full text, mbox, link).
Information forwarded
to debian-bugs-dist@lists.debian.org, Bernd Zeimetz <bzed@debian.org>:
Bug#869633; Package src:open-vm-tools.
(Tue, 25 Jul 2017 07:45:02 GMT) (full text, mbox, link).
Acknowledgement sent
to Bernd Zeimetz <bernd@bzed.de>:
Extra info received and forwarded to list. Copy sent to Bernd Zeimetz <bzed@debian.org>.
(Tue, 25 Jul 2017 07:45:02 GMT) (full text, mbox, link).
Message #14 received at submit@bugs.debian.org (full text, mbox, reply):
Hi Moritz,
you beat me in opening this bug - vmware notified me already.
Updated packages + security upload are on its way.
cheers,
Bernd
--
Bernd Zeimetz Debian GNU/Linux Developer
http://bzed.de http://www.debian.org
GPG Fingerprint: ECA1 E3F2 8E11 2432 D485 DD95 EB36 171A 6FF9 435F
Information forwarded
to debian-bugs-dist@lists.debian.org, Bernd Zeimetz <bzed@debian.org>:
Bug#869633; Package src:open-vm-tools.
(Tue, 25 Jul 2017 07:45:04 GMT) (full text, mbox, link).
Acknowledgement sent
to Bernd Zeimetz <bernd@bzed.de>:
Extra info received and forwarded to list. Copy sent to Bernd Zeimetz <bzed@debian.org>.
(Tue, 25 Jul 2017 07:45:04 GMT) (full text, mbox, link).
Reply sent
to Bernd Zeimetz <bzed@debian.org>:
You have taken responsibility.
(Tue, 25 Jul 2017 09:21:07 GMT) (full text, mbox, link).
Notification sent
to Moritz Muehlenhoff <jmm@debian.org>:
Bug acknowledged by developer.
(Tue, 25 Jul 2017 09:21:07 GMT) (full text, mbox, link).
Message #24 received at 869633-close@bugs.debian.org (full text, mbox, reply):
Source: open-vm-tools
Source-Version: 2:10.1.5-5055683-5
We believe that the bug you reported is fixed in the latest version of
open-vm-tools, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to 869633@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Bernd Zeimetz <bzed@debian.org> (supplier of updated open-vm-tools package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Format: 1.8
Date: Tue, 25 Jul 2017 10:46:40 +0200
Source: open-vm-tools
Binary: open-vm-tools open-vm-tools-desktop open-vm-tools-dev open-vm-tools-dkms
Architecture: source amd64 all
Version: 2:10.1.5-5055683-5
Distribution: unstable
Urgency: high
Maintainer: Bernd Zeimetz <bzed@debian.org>
Changed-By: Bernd Zeimetz <bzed@debian.org>
Description:
open-vm-tools - Open VMware Tools for virtual machines hosted on VMware (CLI)
open-vm-tools-desktop - Open VMware Tools for virtual machines hosted on VMware (GUI)
open-vm-tools-dev - Open VMware Tools for virtual machines hosted on VMware (developm
open-vm-tools-dkms - Open VMware Tools vmxnet kernel module (deprecated)
Closes: 869633
Changes:
open-vm-tools (2:10.1.5-5055683-5) unstable; urgency=high
.
* [dec8df6] Upstream fix for CVE-2015-5191 (Closes: #869633)
* [718133e] Enable PrivateTmp for the open-vm-tools.service.
Checksums-Sha1:
9e808d7f24c88402a952c78e84223f492ce39d86 2502 open-vm-tools_10.1.5-5055683-5.dsc
8a3bece591b6260ce83030921cd84ee0dd1f27d9 29124 open-vm-tools_10.1.5-5055683-5.debian.tar.xz
c087b6aff5af63fab71a6b848648608a3bc7fc74 2000734 open-vm-tools-dbgsym_10.1.5-5055683-5_amd64.deb
358314e891e74cc881c3e2f4af6d0812fd96e50c 197300 open-vm-tools-desktop-dbgsym_10.1.5-5055683-5_amd64.deb
72019cc83dff496d90753ccee30deb6c3552e0d7 166752 open-vm-tools-desktop_10.1.5-5055683-5_amd64.deb
a30f34936dc7966f92e9321d20d1eaca22305b42 499664 open-vm-tools-dev_10.1.5-5055683-5_amd64.deb
819123ec44b486d7ae913ef5ff53eda40ab7cecc 418420 open-vm-tools-dkms_10.1.5-5055683-5_all.deb
a4459be4500b51d84927283a16950d01a261d690 13609 open-vm-tools_10.1.5-5055683-5_amd64.buildinfo
2a6c42a9340b7da315e877632f016fb8437d8ce0 560778 open-vm-tools_10.1.5-5055683-5_amd64.deb
Checksums-Sha256:
d5d278dcdb89410eb81c5dfaf62d8f04ad40044bf4b950de21a2ed83f2aa3e6f 2502 open-vm-tools_10.1.5-5055683-5.dsc
75987f81ae3af4e32871fe39b3c32ddf1ee96161d3d1949ff7cf9e6c31afa659 29124 open-vm-tools_10.1.5-5055683-5.debian.tar.xz
821c282c8cb3e33345c9b5a127ff3baeb35e3b78017fa19e7152f4ec43a4b37a 2000734 open-vm-tools-dbgsym_10.1.5-5055683-5_amd64.deb
6097a489ae36b4915801c58c503da915601fc0dd9b0c6c7c253efd11d05587f7 197300 open-vm-tools-desktop-dbgsym_10.1.5-5055683-5_amd64.deb
31921583721bd53cfce85c1489b82847ee9d856e3a2ec3655abb8ebd2664f5ea 166752 open-vm-tools-desktop_10.1.5-5055683-5_amd64.deb
502e0eb0cf43e203f2ad86717851b9f526b0832a95a8214f6fa74ff6a76cf662 499664 open-vm-tools-dev_10.1.5-5055683-5_amd64.deb
6a17e5528732b5fd7592e1ed1d1706f3337fc800eb96eb00581ac7c92c6bf018 418420 open-vm-tools-dkms_10.1.5-5055683-5_all.deb
0efcda97109900cab3f00d4a968e93c44c96e7ee5ab7562f2a860917b26aa0a0 13609 open-vm-tools_10.1.5-5055683-5_amd64.buildinfo
3607b4150b4bcf4dd27564f93e69f97318321d6af00da30702cbcb90b9aa7a67 560778 open-vm-tools_10.1.5-5055683-5_amd64.deb
Files:
8304096a6bfbdf83e0eb60b55282f01a 2502 admin extra open-vm-tools_10.1.5-5055683-5.dsc
b04131e8e7c934aef44ce554ef656334 29124 admin extra open-vm-tools_10.1.5-5055683-5.debian.tar.xz
b55c48bbb6f151122da16ca314f322b0 2000734 debug extra open-vm-tools-dbgsym_10.1.5-5055683-5_amd64.deb
4f21a5db72299dc31f2847cac5ebc11d 197300 debug extra open-vm-tools-desktop-dbgsym_10.1.5-5055683-5_amd64.deb
caaebd758f46c7201028860699265da3 166752 admin extra open-vm-tools-desktop_10.1.5-5055683-5_amd64.deb
3e8559b703c06b0f5ac1f203c9b5cca3 499664 devel extra open-vm-tools-dev_10.1.5-5055683-5_amd64.deb
e3c919a71d694a39c0db835762bbab8c 418420 kernel extra open-vm-tools-dkms_10.1.5-5055683-5_all.deb
38b300b92edf1e85ba05938c72f210ee 13609 admin extra open-vm-tools_10.1.5-5055683-5_amd64.buildinfo
2961c394ca4bc16db1d397a1fdb31842 560778 admin extra open-vm-tools_10.1.5-5055683-5_amd64.deb
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCAAdFiEE7KHj8o4RJDLUhd2V6zYXGm/5Q18FAll3Bw0ACgkQ6zYXGm/5
Q18XMA/+KcPsuKex8qQSaDe6EBJKxTtf1hjnJwjUWnYOW2xIgiDUAQLpDQ38diLa
FW7/ZRVtYtn5bbGlPHiZvuAzzshlsbcB7uE+2GF4Im1qiHm00BKwSKNSpEzBQHwt
F1LosfjB9SZQDu8QtTeNKWNuuRVuSlG8JZ2g09ZZJfYkImqrFCKe2vuke3CNsL2h
krBBeDnis4tXZNqDKv+pLw/6jgxvnkPsB35PH4JQJaagNbARNT++QoTVDeGlB6ZN
HEfubTqCCvdxLmjKngIeKMd1SbfxYc0fjJxfk4US8izvqkJntyczMJbJbX4+fLLu
fJjBlGRn08jhPPql9olchyRfbgQ4kXfusRpwJbP1d236tkO/7ej9Y880vGBIuSwa
5Bzw4J5nsPNplUahkryc24SEVOhXr9+1FspqKk4wpQYaKaXpeBV0zQiQ7B3e73Fq
PAvm59qD2UJi9V3C8kWqe4JBo05k6D8HNchwHauo3JwLDvxOU0TwUioyMUExKkVa
+uZAWXmwskFH4BwWGt5hbGXHa1dgklR4yyedX2oKyci635O7EYtpVjeJSYWLHeKG
R6hT2ZQKEkmKey7Nff8aAwocXrY7+tzY7RoCwxbtVlbUXxdfeL5BeaFqPzwQ21VP
EFsGWPXWL6zV0WtN3O/9rgjPw+t3NsTD4YHPjyxycOvT3lpl1sw=
=SCk5
-----END PGP SIGNATURE-----
Information forwarded
to debian-bugs-dist@lists.debian.org, Bernd Zeimetz <bzed@debian.org>:
Bug#869633; Package src:open-vm-tools.
(Tue, 25 Jul 2017 10:39:03 GMT) (full text, mbox, link).
Acknowledgement sent
to 869633@bugs.debian.org:
Extra info received and forwarded to list. Copy sent to Bernd Zeimetz <bzed@debian.org>.
(Tue, 25 Jul 2017 10:39:03 GMT) (full text, mbox, link).
Message #29 received at 869633@bugs.debian.org (full text, mbox, reply):
[Message part 1 (text/plain, inline)]
Hi,
do you want to issue a DSA for that CVE? I don't think the impact is
high enough for that and it could be fixed with the next point release.
A debdiff for the security upload would be attached.
Cheers,
Bernd
--
Bernd Zeimetz Debian GNU/Linux Developer
http://bzed.de http://www.debian.org
GPG Fingerprint: ECA1 E3F2 8E11 2432 D485 DD95 EB36 171A 6FF9 435F
[open-vm-tools.debdiff (text/plain, attachment)]
Information forwarded
to debian-bugs-dist@lists.debian.org, Bernd Zeimetz <bzed@debian.org>:
Bug#869633; Package src:open-vm-tools.
(Tue, 25 Jul 2017 11:15:03 GMT) (full text, mbox, link).
Acknowledgement sent
to Moritz Muehlenhoff <jmm@inutil.org>:
Extra info received and forwarded to list. Copy sent to Bernd Zeimetz <bzed@debian.org>.
(Tue, 25 Jul 2017 11:15:03 GMT) (full text, mbox, link).
Message #34 received at 869633@bugs.debian.org (full text, mbox, reply):
On Tue, Jul 25, 2017 at 12:35:08PM +0200, Bernd Zeimetz wrote:
> Hi,
>
> do you want to issue a DSA for that CVE? I don't think the impact is
> high enough for that and it could be fixed with the next point release.
I agree, this can be fixed via a point release. I'm updating the
Debian security tracker for that.
Cheers,
Moritz
Reply sent
to Bernd Zeimetz <bzed@debian.org>:
You have taken responsibility.
(Wed, 23 Aug 2017 20:51:22 GMT) (full text, mbox, link).
Notification sent
to Moritz Muehlenhoff <jmm@debian.org>:
Bug acknowledged by developer.
(Wed, 23 Aug 2017 20:51:22 GMT) (full text, mbox, link).
Message #39 received at 869633-close@bugs.debian.org (full text, mbox, reply):
Source: open-vm-tools
Source-Version: 2:10.1.5-5055683-4+deb9u1
We believe that the bug you reported is fixed in the latest version of
open-vm-tools, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to 869633@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Bernd Zeimetz <bzed@debian.org> (supplier of updated open-vm-tools package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Format: 1.8
Date: Tue, 25 Jul 2017 11:40:02 +0200
Source: open-vm-tools
Binary: open-vm-tools open-vm-tools-desktop open-vm-tools-dev open-vm-tools-dkms
Architecture: source amd64 all
Version: 2:10.1.5-5055683-4+deb9u1
Distribution: stretch
Urgency: medium
Maintainer: Bernd Zeimetz <bzed@debian.org>
Changed-By: Bernd Zeimetz <bzed@debian.org>
Description:
open-vm-tools - Open VMware Tools for virtual machines hosted on VMware (CLI)
open-vm-tools-desktop - Open VMware Tools for virtual machines hosted on VMware (GUI)
open-vm-tools-dev - Open VMware Tools for virtual machines hosted on VMware (developm
open-vm-tools-dkms - Open VMware Tools vmxnet kernel module (deprecated)
Closes: 869633
Changes:
open-vm-tools (2:10.1.5-5055683-4+deb9u1) stretch; urgency=medium
.
* [dec8df6] Upstream fix for CVE-2015-5191 (Closes: #869633)
* [ff10dcb] Update gbp.conf for stretch.
Checksums-Sha1:
12812c4a87cec78edca51c1c6062e9b4bce416f8 2530 open-vm-tools_10.1.5-5055683-4+deb9u1.dsc
5374dd0dd7b5190449c99e2ee0071b98d230416c 29128 open-vm-tools_10.1.5-5055683-4+deb9u1.debian.tar.xz
b8278a9594e16559cea45a72954dfd80dc239c98 2000734 open-vm-tools-dbgsym_10.1.5-5055683-4+deb9u1_amd64.deb
beb5dfa9a91c9b381b3fe072c173ba6869ed531c 197262 open-vm-tools-desktop-dbgsym_10.1.5-5055683-4+deb9u1_amd64.deb
faeeffad7a55ffd220659a98dd9a034fcd598305 166788 open-vm-tools-desktop_10.1.5-5055683-4+deb9u1_amd64.deb
c1b7ce373aa7d24a61f6c0ecd033c5c10300d510 499558 open-vm-tools-dev_10.1.5-5055683-4+deb9u1_amd64.deb
2a3ea7ba442e9afce5b774aed8a20757c75b7f44 418366 open-vm-tools-dkms_10.1.5-5055683-4+deb9u1_all.deb
afac67016c1b98e9da861d63834ee44d3ed31d2f 13673 open-vm-tools_10.1.5-5055683-4+deb9u1_amd64.buildinfo
f8493fade20417da30c6c66a16a63ca6a37e6459 561360 open-vm-tools_10.1.5-5055683-4+deb9u1_amd64.deb
Checksums-Sha256:
e21809aa160b14a0d4da41d083dc9fa749adc2f397b3227d3657fed4b67a20d8 2530 open-vm-tools_10.1.5-5055683-4+deb9u1.dsc
5c7896486b0cfa5c64fc388015b265f824d6d9c62eec3dcd90bf860e6ac69b84 29128 open-vm-tools_10.1.5-5055683-4+deb9u1.debian.tar.xz
79a3d15efc23f6ddc5a778af73704ae88403a6bc3dbcb02f302a4888d7be16de 2000734 open-vm-tools-dbgsym_10.1.5-5055683-4+deb9u1_amd64.deb
18312a33688a6cd4c9384ebcd4f6da010aa80e8e46e6e4d18ab96d7de5c7fd79 197262 open-vm-tools-desktop-dbgsym_10.1.5-5055683-4+deb9u1_amd64.deb
7bb49cb50ba8512631f64a4c288a3b40f81a21a203fe84ad51297682474015f9 166788 open-vm-tools-desktop_10.1.5-5055683-4+deb9u1_amd64.deb
975f5abc441f0d2610b004a8e9db6aee9402d7f3a6c9052e893bd5d8e3ba84d4 499558 open-vm-tools-dev_10.1.5-5055683-4+deb9u1_amd64.deb
034229a0c1c6de0643d38327d7d0d360b76417b30106972d6ffa796ff7be61da 418366 open-vm-tools-dkms_10.1.5-5055683-4+deb9u1_all.deb
fadb25a5da5b403c60418d0f48398e22950da879428b598d3c98d346cf936744 13673 open-vm-tools_10.1.5-5055683-4+deb9u1_amd64.buildinfo
c80ca51d60828e056669e052546dd9907a3722e6594453969843deae977aaef4 561360 open-vm-tools_10.1.5-5055683-4+deb9u1_amd64.deb
Files:
b8e1a86b0c05d1d2c8f17ffdc2e01c78 2530 admin extra open-vm-tools_10.1.5-5055683-4+deb9u1.dsc
fbd9293f4b12339d8bd6e738ee2b8bf8 29128 admin extra open-vm-tools_10.1.5-5055683-4+deb9u1.debian.tar.xz
7db8425e8ae4179c8bdee061857c17c2 2000734 debug extra open-vm-tools-dbgsym_10.1.5-5055683-4+deb9u1_amd64.deb
b7fcbbfd303cde2bc53b37441e19a21c 197262 debug extra open-vm-tools-desktop-dbgsym_10.1.5-5055683-4+deb9u1_amd64.deb
2c12df0842919f9a246213aaa8fe3409 166788 admin extra open-vm-tools-desktop_10.1.5-5055683-4+deb9u1_amd64.deb
16a3f0fc43bc3f4bb13a5494ec4a0fab 499558 devel extra open-vm-tools-dev_10.1.5-5055683-4+deb9u1_amd64.deb
6ba712c06d2be7abb4d997f3fe08f4c9 418366 kernel extra open-vm-tools-dkms_10.1.5-5055683-4+deb9u1_all.deb
ef659fae5dd3cc25915642e5d97968d1 13673 admin extra open-vm-tools_10.1.5-5055683-4+deb9u1_amd64.buildinfo
9f33eb364018b4b0ed13e4a3983b57a5 561360 admin extra open-vm-tools_10.1.5-5055683-4+deb9u1_amd64.deb
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCAAdFiEE7KHj8o4RJDLUhd2V6zYXGm/5Q18FAlmPW1EACgkQ6zYXGm/5
Q1/ZdhAAuuJnd7jF/8/Cspr3n5hQNqys8pP7P7AW+oHprYobnWMUX9IeIO91r81f
P22hdjqM07B3E47xKC7cH2LTUZjdDqyVnYas4RMOGrCJbboNMilYkJZAmrZ24u8W
rQH9MLWDL3PkI85tQTpIAl0w39ddVHAwEI77IJkrqlr1H69Yl2LyUba57VY36g5z
BbgmVbak4twBkUQTc4YiPJE+wYBAiPn4OqqMRDhwcU9hLZRAoWoyWkIkrJkVvXc9
hFfa9QJOIbTl+uNkUBn5Psau9+MH1xa/wB0VDaJaWMH/uGX90a8NbeKeRsRLS5OG
0RQjwLBqTTW22e0upOoZyIvv6JwtcQurFSPA/7BLxar3bOcFVSWv2Sb7w4ji8qZQ
WRBHBAo01NnfD47+hvFPAo4GUdMjdgrEA5B657+d0cIToDni6QXTm84CxBLBNJth
3xwXIMXKrgxPsByIdelMdFdUQYLCQE0+Fq0jE93klcjsBVAx/s1yzQbWRZHhxy0S
dWbOtKFOUowz8XoD9JdIip6HGoI+7EXc4tirSy56YwRFVzlNNoHGG5xqO8JfU+Hp
Uo2HrsK+3aGqp3KhjzMlwbv/DEQjLByyo225jX2+0Cwf6YgWLfr/uDeYi6mrL/kb
4uEjX5fmaGAeAcGDyy4DTvNLU4ot4BPKvukUd5qQGORWoln7IMU=
=8vgA
-----END PGP SIGNATURE-----
Bug archived.
Request was from Debbugs Internal Request <owner@bugs.debian.org>
to internal_control@bugs.debian.org.
(Tue, 24 Oct 2017 07:27:44 GMT) (full text, mbox, link).
Send a report that this bug log contains spam.
Debian bug tracking system administrator <owner@bugs.debian.org>.
Last modified:
Wed Jun 19 19:09:30 2019;
Machine Name:
buxtehude
Debian Bug tracking system
Debbugs is free software and licensed under the terms of the GNU
Public License version 2. The current version can be obtained
from https://bugs.debian.org/debbugs-source/.
Copyright © 1999 Darren O. Benham,
1997,2003 nCipher Corporation Ltd,
1994-97 Ian Jackson,
2005-2017 Don Armstrong, and many other contributors.
Vulmon