Multiple vulnerabilities in Oracle VM VirtualBox

Description

Multiple serious vulnerabilities have been found in Oracle VM VirtualBox. Malicious users can exploit these vulnerabilities to cause a denial of service, read and write accesible data and possibly to obtain sensitive information.

Below is a complete list of vulnerabilities:

1. Multiple unspecified vulnerabilities in subcomponent Core of Oracle Virtualization component can be exploited remotely possibly to obtain sensitive information;
2. Multiple unspecified vulnerabilities in subcomponent Core of Oracle Virtualization component can be exploited remotely to cause a denial of service (it can be either hang or frequently repeatable crash), write to some of Oracle VM VirtualBox accessible data and read a subset of Oracle VM VirtualBox accessible data;
3. An unspecified vulnerability in subcomponent Shared Folder of Oracle Virtualization component can be exploited remotely to cause a denial of service (it can be either hang or frequently repeatable crash);
4. An unspecified vulnerability in subcomponent Core of Oracle Virtualization component can be exploited remotely to cause a denial of service (it can be either hang or frequently repeatable crash), write to some of Oracle VM VirtualBox accessible data and read a subset of Oracle VM VirtualBox accessible data;
5. An unspecified vulnerability in subcomponent Core of Oracle Virtualization component can be exploited remotely to cause a denial of service (it can be either hang or frequently repeatable crash), write to some of Oracle VM VirtualBox accessible data;
6. An unspecified vulnerability in subcomponent Core of Oracle Virtualization component can be exploited remotely to read a subset of Oracle VM VirtualBox accessible data.

---

Technical details

Vulnerabilities (1)-(3) can be exploited by a low privileged user with logon to the infrastructure where OracleVM VirtualBox is executed.

Vulnerabilities (4)-(6) can be exploited by a high privileged user with logon to the infrastructure where OracleVM VirtualBox is executed.

Original advisories

• Oracle Critical Patch Update Advisory

Exploitation

Public exploits exist for this vulnerability.

Related products

• Oracle-VirtualBox

CVE list

• CVE-2017-3575
  warning
• CVE-2017-3576
  warning
• CVE-2017-3513
  warning
• CVE-2017-3587
  warning
• CVE-2017-3558
  warning
• CVE-2017-3559
  warning
• CVE-2017-3561
  warning
• CVE-2017-3563
  warning

Read more

Find out the statistics of the vulnerabilities spreading in your region on statistics.securelist.com