KLA11236 Multiple vulnerabilities in Oracle VM VirtualBox

Multiple serious vulnerabilities have been found in Oracle VM VirtualBox. Malicious users can exploit these vulnerabilities to cause denial of service, obtain sensitive information, gain privileges, read and write local files.

Below is a complete list of vulnerabilities:

1. Multiple unspecified vulnerabilities in the Core component can be exploited locally to gain privileges;
2. An unspecified vulnerability in the Core component can be exploited remotely to cause denial of service, obtain sensitive information, read and write local files;
3. An unspecified vulnerability in the Core component can be exploited remotely to obtain sensitive information.

Original advisories

Oracle Critical Patch Update Advisory – April 2018

Related products

Oracle-VirtualBox

CVE list

CVE-2018-2835 warning

CVE-2018-2836 warning

CVE-2018-2837 warning

CVE-2018-0739 warning

CVE-2018-2842 warning

CVE-2018-2843 warning

CVE-2018-2844 warning

CVE-2018-2845 warning

CVE-2018-2860 warning

CVE-2018-2830 warning

CVE-2018-2831 warning

Solution

Update to the latest version

Download VirtualBox

Impacts

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

• WLF

Write Local Files. Exploitation of vulnerabilities with this impact can lead to writing into some inaccessible files. Files that can be read depends on concrete program errors.

• PE

Privilege escalation. Exploitation of vulnerabilities with this impact can lead to performing by abuser actions, which are normally disallowed for current role.

• RLF

Read Local Files. Exploitation of vulnerabilities with this impact can lead to reading some inaccessible files. Files that can be read depends on conсrete program errors.

Affected Products

• Oracle VM VirtualBox 5.1.x earlier than 5.1.36Oracle VM VirtualBox 5.2.x earlier than 5.2.10