vm-support 0.88 in VMware Tools, as distributed with VMware Workstation through 10.0.3 and other products, allows local users to write to arbitrary files via a symlink attack on a file in /tmp.
{ "binaries": [ { "binary_version": "2:9.4.0-1280544-5ubuntu6.4+esm1", "binary_name": "open-vm-dkms" }, { "binary_version": "2:9.4.0-1280544-5ubuntu6.4+esm1", "binary_name": "open-vm-dkms-lts-trusty" }, { "binary_version": "2:9.4.0-1280544-5ubuntu6.4+esm1", "binary_name": "open-vm-toolbox" }, { "binary_version": "2:9.4.0-1280544-5ubuntu6.4+esm1", "binary_name": "open-vm-toolbox-lts-trusty" }, { "binary_version": "2:9.4.0-1280544-5ubuntu6.4+esm1", "binary_name": "open-vm-tools" }, { "binary_version": "2:9.4.0-1280544-5ubuntu6.4+esm1", "binary_name": "open-vm-tools-desktop" }, { "binary_version": "2:9.4.0-1280544-5ubuntu6.4+esm1", "binary_name": "open-vm-tools-dev" }, { "binary_version": "2:9.4.0-1280544-5ubuntu6.4+esm1", "binary_name": "open-vm-tools-dkms" }, { "binary_version": "2:9.4.0-1280544-5ubuntu6.4+esm1", "binary_name": "open-vm-tools-lts-trusty" }, { "binary_version": "2:9.4.0-1280544-5ubuntu6.4+esm1", "binary_name": "open-vm-tools-lts-trusty-desktop" }, { "binary_version": "2:9.4.0-1280544-5ubuntu6.4+esm1", "binary_name": "open-vm-tools-lts-trusty-dev" }, { "binary_version": "2:9.4.0-1280544-5ubuntu6.4+esm1", "binary_name": "open-vm-tools-lts-trusty-dkms" } ], "availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro" }