CVE-2017-11741

CVE-2017-11741 affects HashiCorp Vagrant VMware Fusion plugin (vagrant-vmware-fusion) prior to 4.0.24. The issue stems from weak permissions granted to the plugin’s sudo helper scripts, enabling a local attacker to overwrite the scripts and execute arbitrary code with root privileges. Public refe...

CVE-2017-15884

HashiCorp Vagrant VMware Fusion plugin (vagrant-vmware-fusion) 5.0.0 is affected by a local privilege escalation: a bug in the plugin update mechanism allows a local attacker to silently subvert the update process and escalate to root. The issue involves the updater reinstalling the plugin (inclu...

CVE-2017-7642

The CVE-2017-7642 entry concerns the HashiCorp Vagrant VMware Fusion plugin (vagrant-vmware-fusion) prior to 4.0.21. The vulnerability is a local privilege escalation via the plugin’s sudo helper, caused by failure to verify the path to the encoded Ruby script or by manipulating the PATH variable...

CVE-2017-12579

The CVE concerns the HashiCorp Vagrant VMware Fusion plugin (vagrant-vmware-fusion) up to version 4.0.24, where an insecure SUID wrapper binary allows a non-root user to obtain a root shell. The root cause is described as a design/implementation flaw in the plugin’s handling of privileged operati...

CVE-2017-16839

CVE-2017-16839 affects Hashicorp vagrant-vmware-fusion 5.0.4. Connected sources confirm a local elevation of privilege: a local attacker could obtain root privileges, with the NVD note tying this to scenarios where VMware Fusion is not installed. The CNVD entry reinforces a local privilege escala...

CVE-2017-16873

CVE-2017-16873 affects vagrant-vmware-fusion versions 4.0.25 through 5.0.4. A vulnerability in an unsanitized PATH within the suid binary can be exploited to escalate to root privileges locally. Connected sources corroborate a local privilege escalation without details on exploitation vectors bey...

CVE-2017-16512

The CVE-2017-16512 entry describes a local privilege escalation in Hashicorp vagrant-vmware-fusion, affecting versions 5.0.2 through 5.0.4. The vulnerability exists in the vagrant update process and lets a local attacker steal root privileges via a crafted update request when no updates are avail...