Gentoo update for Oracle VirtualBox



Risk High
Patch available YES
Number of vulnerabilities 6
CVE-ID CVE-2023-21884
CVE-2023-21885
CVE-2023-21886
CVE-2023-21889
CVE-2023-21898
CVE-2023-21899
CWE-ID CWE-20
CWE-388
Exploitation vector Network
Public exploit N/A
Vulnerable software
 Gentoo Linux
Operating systems & Components / Operating system

app-emulation/virtualbox
Operating systems & Components / Operating system package or component

Vendor Gentoo

Security Bulletin

This security bulletin contains information about 6 vulnerabilities.

1) Improper input validation

EUVDB-ID: #VU71258

Risk: Low

CVSSv4.0: 4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-21884

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a local privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Core component in Oracle VM VirtualBox. A local privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.

Mitigation

Update the affected packages.
app-emulation/virtualbox to version:

Vulnerable software versions

Gentoo Linux: All versions

app-emulation/virtualbox: before 6.1.12

CPE2.3 External links

https://security.gentoo.org/glsa/202310-07


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Improper input validation

EUVDB-ID: #VU71259

Risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-21885

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a local authenticated user to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Core component in Oracle VM VirtualBox. A local authenticated user can exploit this vulnerability to gain access to sensitive information.

Mitigation

Update the affected packages.
app-emulation/virtualbox to version:

Vulnerable software versions

Gentoo Linux: All versions

app-emulation/virtualbox: before 6.1.12

CPE2.3 External links

https://security.gentoo.org/glsa/202310-07


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Error Handling

EUVDB-ID: #VU71255

Risk: High

CVSSv4.0: 7.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2023-21886

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper error handling within the Teleporter service. A remote non-authenticated attacker can bypass authentication process and compromise the application.

Mitigation

Update the affected packages.
app-emulation/virtualbox to version:

Vulnerable software versions

Gentoo Linux: All versions

app-emulation/virtualbox: before 6.1.12

CPE2.3 External links

https://security.gentoo.org/glsa/202310-07


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Improper input validation

EUVDB-ID: #VU71260

Risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-21889

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a local authenticated user to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Core component in Oracle VM VirtualBox. A local authenticated user can exploit this vulnerability to gain access to sensitive information.

Mitigation

Update the affected packages.
app-emulation/virtualbox to version:

Vulnerable software versions

Gentoo Linux: All versions

app-emulation/virtualbox: before 6.1.12

CPE2.3 External links

https://security.gentoo.org/glsa/202310-07


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Improper input validation

EUVDB-ID: #VU71256

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-21898

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a local authenticated user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Core component in Oracle VM VirtualBox. A local authenticated user can exploit this vulnerability to perform a denial of service (DoS) attack.

Mitigation

Update the affected packages.
app-emulation/virtualbox to version:

Vulnerable software versions

Gentoo Linux: All versions

app-emulation/virtualbox: before 6.1.12

CPE2.3 External links

https://security.gentoo.org/glsa/202310-07


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Improper input validation

EUVDB-ID: #VU71257

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-21899

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a local authenticated user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Core component in Oracle VM VirtualBox. A local authenticated user can exploit this vulnerability to perform a denial of service (DoS) attack.

Mitigation

Update the affected packages.
app-emulation/virtualbox to version:

Vulnerable software versions

Gentoo Linux: All versions

app-emulation/virtualbox: before 6.1.12

CPE2.3 External links

https://security.gentoo.org/glsa/202310-07


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###