Описание
Multiple serious vulnerabilities have been found in Oracle VM VirtualBox. Malicious users can exploit these vulnerabilities to obtain sensitive information and gain privileges.
Below is a complete list of vulnerabilities:
- Multiple unspecified vulnerabilities in Core subcomponent of Oracle Virtualization can be exploited locally to gain privileges and possibly to obtain sensitive information;
- An unspecified vulnerability in Guest Additions subcomponent of Oracle Virtualization can be exploited locally to gain privileges and possibly to obtain sensitive information;
- Vulnerability in OpenSSL component of Oracle VM VirtualBox can be exploited remotely via using a carry propagation flaw in the x86_64 Montgomery squaring function to obtain sensitive information about the SSL private keys.
Technical details
Vulnerability (3) affects only OpenSSL before 1.0.2m and 1.1.0 before 1.1.0g on the processors that support the BMI1, BMI2 and ADX extensions like Intel Broadwell (5th generation) and later or AMD Ryzen.
Первичный источник обнаружения
Эксплуатация
Public exploits exist for this vulnerability.
Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.
Связанные продукты
Список CVE
- CVE-2017-5715 warning
- CVE-2018-2676 warning
- CVE-2017-3736 warning
- CVE-2018-2685 warning
- CVE-2018-2686 warning
- CVE-2018-2687 warning
- CVE-2018-2688 warning
- CVE-2018-2689 warning
- CVE-2018-2690 warning
- CVE-2018-2693 warning
- CVE-2018-2694 warning
- CVE-2018-2698 warning
Смотрите также
Узнай статистику распространения уязвимостей в своем регионе statistics.securelist.com