Advisories ยป MGASA-2014-0185

Updated virtualbox packages fixes security vulnerabilities

Publication date: 20 Apr 2014
Modification date: 20 Apr 2014
Type: security
Affected Mageia releases : 4
CVE: CVE-2014-0981 , CVE-2014-0983

Description

VBox/GuestHost/OpenGL/util/net.c in Oracle VirtualBox before 3.2.22, 4.0.x
before 4.0.24, 4.1.x before 4.1.32, 4.2.x before 4.2.24, and 4.3.x before
4.3.8, when using 3D Acceleration allows local guest OS users to execute
arbitrary code on the Chromium server via crafted Chromium network pointer
in a CR_MESSAGE_READBACK or CR_MESSAGE_WRITEBACK message to the
VBoxSharedCrOpenGL service, which triggers an arbitrary pointer
dereference and memory corruption (CVE-2014-0981).

Multiple array index errors in programs that are automatically generated
by VBox/HostServices/SharedOpenGL/crserverlib/server_dispatch.py in Oracle
VirtualBox 4.2.x through 4.2.20 and 4.3.x before 4.3.8, when using 3D
Acceleration, allow local guest OS users to execute arbitrary code on the
Chromium server via certain CR_MESSAGE_OPCODES messages with a crafted
index, which are not properly handled (CVE-2014-0983).

The virtualbox packages has been updated to 4.3.10 maintenance release
that resolves theese issues and other upstream reported issues (for more
info check the referenced changelog).

This update also resolves the following:
- load virtualbox modules on install (mga#8826)
- missing GUI translations (mga#12578)

References

SRPMS

4/core