{"id":"MGASA-2018-0360","summary":"Updated virtualbox packages fix security vulnerabilities","details":"This update provides the virtualbox 5.1.18 maintenance release that\nfixes at least the following security issues:\n\nFixed an easily exploitable vulnerability that allowed unauthenticated\nattacker with logon to the infrastructure where Oracle VM VirtualBox\nexecutes to compromise Oracle VM VirtualBox. Successful attacks of this\nvulnerability can result in unauthorized ability to cause a partial denial\nof service (partial DOS) of Oracle VM VirtualBox (CVE-2018-3005).\n\nFixed an easily exploitable vulnerability that allowed unauthenticated\nattacker with logon to the infrastructure where Oracle VM VirtualBox\nexecutes to compromise Oracle VM VirtualBox. Successful attacks require\nhuman interaction from a person other than the attacker and while the\nvulnerability is in Oracle VM VirtualBox, attacks may significantly impact\nadditional products. Successful attacks of this vulnerability can result\nin unauthorized ability to cause a hang or frequently repeatable crash\n(complete DOS) of Oracle VM VirtualBox and unauthorized read access to a\nsubset of Oracle VM VirtualBox accessible data (CVE-2018-3055).\n\nFixed an easily exploitable vulnerability that allowed unauthenticated\nattacker with logon to the infrastructure where Oracle VM VirtualBox\nexecutes to compromise Oracle VM VirtualBox. Successful attacks require\nhuman interaction from a person other than the attacker and while the\nvulnerability is in Oracle VM VirtualBox, attacks may significantly impact\nadditional products. Successful attacks of this vulnerability can result\nin unauthorized creation, deletion or modification access to critical data\nor all Oracle VM VirtualBox accessible data as well as unauthorized read\naccess to a subset of Oracle VM VirtualBox accessible data and unauthorized\nability to cause a hang or frequently repeatable crash (complete DOS) of\nOracle VM VirtualBox (CVE-2018-3085).\n\nFixed an easily exploitable vulnerability that allowed unauthenticated\nattacker with logon to the infrastructure where Oracle VM VirtualBox\nexecutes to compromise Oracle VM VirtualBox. Successful attacks require\nhuman interaction from a person other than the attacker and while the\nvulnerability is in Oracle VM VirtualBox, attacks may significantly impact\nadditional products. Successful attacks of this vulnerability can result\nin takeover of Oracle VM VirtualBox (CVE-2018-3086, CVE-2018-3087,\nCVE-2018-3088, CVE-2018-3089, CVE-2018-3090).\n\nFixed an easily exploitable vulnerability allows unauthenticated attacker\nwith logon to the infrastructure where Oracle VM VirtualBox executes to\ncompromise Oracle VM VirtualBox. Successful attacks require human\ninteraction from a person other than the attacker and while the\nvulnerability is in Oracle VM VirtualBox, attacks may significantly impact\nadditional products. Successful attacks of this vulnerability can result\nin unauthorized access to critical data or complete access to all Oracle\nVM VirtualBox accessible data (CVE-2018-3091).\n\nFor other fixes in this update, see the referenced changelog.\n","modified":"2026-04-16T06:23:27.388698283Z","published":"2018-08-31T21:11:59Z","upstream":["CVE-2018-3005","CVE-2018-3055","CVE-2018-3085","CVE-2018-3086","CVE-2018-3087","CVE-2018-3088","CVE-2018-3089","CVE-2018-3090","CVE-2018-3091"],"references":[{"type":"ADVISORY","url":"https://advisories.mageia.org/MGASA-2018-0360.html"},{"type":"REPORT","url":"https://bugs.mageia.org/show_bug.cgi?id=23421"},{"type":"ADVISORY","url":"http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html#AppendixOVIR"},{"type":"WEB","url":"https://lists.opensuse.org/opensuse-updates/2018-08/msg00077.html"},{"type":"WEB","url":"https://www.virtualbox.org/wiki/Changelog#18"}],"affected":[{"package":{"name":"virtualbox","ecosystem":"Mageia:6","purl":"pkg:rpm/mageia/virtualbox?arch=source&distro=mageia-6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.18-1.mga6"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2018-0360.json"}},{"package":{"name":"kmod-virtualbox","ecosystem":"Mageia:6","purl":"pkg:rpm/mageia/kmod-virtualbox?arch=source&distro=mageia-6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.18-1.mga6"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2018-0360.json"}},{"package":{"name":"kmod-vboxadditions","ecosystem":"Mageia:6","purl":"pkg:rpm/mageia/kmod-vboxadditions?arch=source&distro=mageia-6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.18-1.mga6"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2018-0360.json"}}],"schema_version":"1.7.5","credits":[{"name":"Mageia","contact":["https://wiki.mageia.org/en/Packages_Security_Team"],"type":"COORDINATOR"}]}