MGASA-2018-0101

Dashboard / Vulnerabilities / MGASA-2018-0101

MGASA-2018-0101

Summary: Updated virtualbox packages fix security vulnerabilities

Details: Oracle VM VirtualBox incorporate the OpenSSL software libraries to provide cryptographic capabilities. OpenSSL versions through 1.0.2m and 1.1.0g are susceptible to a vulnerability that could allow an attacker to recover encryption keys and access protected communications (CVE-2017-3736). Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis (CVE-2017-5715). Oracle VM VirtualBox prior to 5.2.6 has easily exploitable vulnerabilities that allows high privileged attacker with logon to the infrastructure where VirtualBox executes to compromise it. While the vulnerability is in VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of VirtualBox (CVE-2018-2676). Oracle VM VirtualBox prior to 5.2.6 has easily exploitable vulnerabilities that allows unauthenticated attacker with logon to the infrastructure where VirtualBox executes to compromise it. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of VirtualBox (CVE-2018-2685, CVE-2018-2686, CVE-2018-2687, CVE-2018-2688, CVE-2018-2689, CVE-2018-2690). Oracle VM VirtualBox Guest Additions prior to 5.2.6 has an easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where VirtualBox executes to compromise it. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of VirtualBox (CVE-2018-2693). Oracle VM VirtualBox prior to 5.2.6 has easily exploitable vulnerabilities that allows low privileged attacker with logon to the infrastructure where VirtualBox executes to compromise it. While the vulnerability is in VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of VirtualBox (CVE-2018-2694, CVE-2018-2698). For other fixes in this update, see the referenced changelog.

References: https://advisories.mageia.org/MGASA-2018-0101.html, https://bugs.mageia.org/show_bug.cgi?id=22408, http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html#AppendixOVIR, https://www.virtualbox.org/wiki/Changelog