==========================================================================
Ubuntu Security Notice USN-6463-2
December 06, 2023
open-vm-tools vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 18.04 LTS (Available with Ubuntu Pro)
- Ubuntu 16.04 LTS (Available with Ubuntu Pro)
Summary:
Several security issues were fixed in Open VM Tools.
Software Description:
- open-vm-tools: Open VMware Tools for virtual machines hosted on VMware
Details:
USN-6463-1 fixed vulnerabilities in Open VM Tools. This update provides
the corresponding updates for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.
Original advisory details:
  It was discovered that Open VM Tools incorrectly handled SAML tokens. A
  remote attacker with Guest Operations privileges could possibly use this
  issue to elevate their privileges. (CVE-2023-34058)
  Matthias Gerstner discovered that Open VM Tools incorrectly handled file
  descriptors when dropping privileges. A local attacker could possibly use
  this issue to hijack /dev/uinput and simulate user inputs.
  (CVE-2023-34059)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 18.04 LTS (Available with Ubuntu Pro):
   open-vm-tools                   2:11.0.5-4ubuntu0.18.04.3+esm3
   open-vm-tools-desktop     2:11.0.5-4ubuntu0.18.04.3+esm3
Ubuntu 16.04 LTS (Available with Ubuntu Pro):
   open-vm-tools                   2:10.2.0-3~ubuntu0.16.04.1+esm4
   open-vm-tools-desktop     2:10.2.0-3~ubuntu0.16.04.1+esm4
In general, a standard system update will make all the necessary changes.
References:
   https://ubuntu.com/security/notices/USN-6463-2
   https://ubuntu.com/security/notices/USN-6463-1
   CVE-2023-34058, CVE-2023-34059