Advisories ยป MGASA-2018-0101

Updated virtualbox packages fix security vulnerabilities

Publication date: 25 Jan 2018
Modification date: 25 Jan 2018
Type: security
Affected Mageia releases : 6
CVE: CVE-2017-3736 , CVE-2017-5715 , CVE-2018-2676 , CVE-2018-2685 , CVE-2018-2686 , CVE-2018-2687 , CVE-2018-2688 , CVE-2018-2689 , CVE-2018-2690 , CVE-2018-2693 , CVE-2018-2694 , CVE-2018-2698

Description

Oracle VM VirtualBox incorporate the OpenSSL software libraries to provide
cryptographic capabilities. OpenSSL versions through 1.0.2m and 1.1.0g are
susceptible to a vulnerability that could allow an attacker to recover
encryption keys and access protected communications (CVE-2017-3736).

Systems with microprocessors utilizing speculative execution and indirect
branch prediction may allow unauthorized disclosure of information to an
attacker with local user access via a side-channel analysis (CVE-2017-5715).

Oracle VM VirtualBox prior to 5.2.6 has easily exploitable vulnerabilities
that allows high privileged attacker with logon to the infrastructure where
VirtualBox executes to compromise it. While the vulnerability is in 
VirtualBox, attacks may significantly impact additional products. Successful
attacks of this vulnerability can result in takeover of VirtualBox  
(CVE-2018-2676).

Oracle VM VirtualBox prior to 5.2.6 has easily exploitable vulnerabilities
that allows unauthenticated attacker with logon to the infrastructure where
VirtualBox executes to compromise it. Successful attacks require human
interaction from a person other than the attacker and while the
vulnerability is in VirtualBox, attacks may significantly impact additional
products. Successful attacks of this vulnerability can result in takeover
of VirtualBox (CVE-2018-2685, CVE-2018-2686, CVE-2018-2687, CVE-2018-2688,
CVE-2018-2689, CVE-2018-2690).

Oracle VM VirtualBox Guest Additions prior to 5.2.6 has an easily exploitable
vulnerability allows low privileged attacker with logon to the infrastructure
where VirtualBox executes to compromise it. Successful attacks require human
interaction from a person other than the attacker and while the vulnerability
is in VirtualBox, attacks may significantly impact additional products.
Successful attacks of this vulnerability can result in takeover of VirtualBox
(CVE-2018-2693).

Oracle VM VirtualBox prior to 5.2.6 has easily exploitable vulnerabilities
that allows low privileged attacker with logon to the infrastructure where
VirtualBox executes to compromise it. While the vulnerability is in 
VirtualBox, attacks may significantly impact additional products. Successful
attacks of this vulnerability can result in takeover of VirtualBox
(CVE-2018-2694, CVE-2018-2698).

For other fixes in this update, see the referenced changelog.

References

SRPMS

6/core