Description
Multiple serious vulnerabilities have been found in Oracle VM VirtualBox. Malicious users can exploit these vulnerabilities to obtain sensitive information and gain privileges.
Below is a complete list of vulnerabilities:
- Multiple unspecified vulnerabilities in Core subcomponent of Oracle Virtualization can be exploited locally to gain privileges and possibly to obtain sensitive information;
- An unspecified vulnerability in Guest Additions subcomponent of Oracle Virtualization can be exploited locally to gain privileges and possibly to obtain sensitive information;
- Vulnerability in OpenSSL component of Oracle VM VirtualBox can be exploited remotely via using a carry propagation flaw in the x86_64 Montgomery squaring function to obtain sensitive information about the SSL private keys.
Technical details
Vulnerability (3) affects only OpenSSL before 1.0.2m and 1.1.0 before 1.1.0g on the processors that support the BMI1, BMI2 and ADX extensions like Intel Broadwell (5th generation) and later or AMD Ryzen.
Original advisories
Exploitation
Public exploits exist for this vulnerability.
Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.
Related products
CVE list
- CVE-2017-5715 warning
- CVE-2018-2676 warning
- CVE-2017-3736 warning
- CVE-2018-2685 warning
- CVE-2018-2686 warning
- CVE-2018-2687 warning
- CVE-2018-2688 warning
- CVE-2018-2689 warning
- CVE-2018-2690 warning
- CVE-2018-2693 warning
- CVE-2018-2694 warning
- CVE-2018-2698 warning
Read more
Find out the statistics of the vulnerabilities spreading in your region on statistics.securelist.com