Upstream fix: https://github.com/vmware/open-vm-tools/tree/CVE-2025-22247.patch

Whiteboard: (none) => MGA9TOO
Source RPM: (none) => open-vm-tools-12.4.5-3.mga10.src.rpm, open-vm-tools-12.3.5-2.mga9.src.rpm
CVE: (none) => CVE-2025-22247
Status comment: (none) => Patch available from upstream

Assigning directly to you, David, as you seem to be by far the main commiter of this package.

Assignee: bugsquad => geiger.david68210

Fedora has issued an advisory on May 20:
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YDQBVVMNJB6EXDLSUNBCHZTNRBLXJEFU/

Status comment: Patch available from upstream => Patch available from upstream and fixed upstream in 12.5.2

Suggested advisory:
========================

The updated packages fix a security vulnerability:

VMware Tools contains an insecure file handling vulnerability. A malicious actor with non-administrative privileges on a guest VM may tamper the local files to trigger insecure file operations within that VM. (CVE-2025-22247)

References:
https://www.openwall.com/lists/oss-security/2025/05/12/2
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YDQBVVMNJB6EXDLSUNBCHZTNRBLXJEFU/
========================

Updated packages in core/updates_testing:
========================
open-vm-tools-12.3.5-2.1.mga9
open-vm-tools-desktop-12.3.5-2.1.mga9
open-vm-tools-devel-12.3.5-2.1.mga9
open-vm-tools-salt-minion-12.3.5-2.1.mga9
open-vm-tools-sdmp-12.3.5-2.1.mga9
open-vm-tools-test-12.3.5-2.1.mga9

from SRPM:
open-vm-tools-12.3.5-2.1.mga9.src.rpm

Source RPM: open-vm-tools-12.4.5-3.mga10.src.rpm, open-vm-tools-12.3.5-2.mga9.src.rpm => open-vm-tools-12.3.5-2.mga9.src.rpm
Status comment: Patch available from upstream and fixed upstream in 12.5.2 => (none)
Status: NEW => ASSIGNED
Whiteboard: MGA9TOO => (none)
Version: Cauldron => 9
Assignee: geiger.david68210 => qa-bugs

MGA9-64 Plasma Wayland on Compaq H000SB
No installation issues.
Ref bug 32454, OK on clean install.

Whiteboard: (none) => MGA9-64-OK
CC: (none) => herman.viaene

Validating.

Keywords: (none) => validated_update
CC: (none) => andrewsfarm, sysadmin-bugs

An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2025-0166.html

Status: ASSIGNED => RESOLVED
Resolution: (none) => FIXED