{"id":"openSUSE-SU-2021:0630-1","summary":"Security update for virtualbox","details":"This update for virtualbox fixes the following issues:\n\n- Version bump to 6.1.20 (released April 20 2021 by Oracle)\n  Fixes boo#1183329 'virtualbox 6.1.18 crashes when it runs nested VM'\n  Fixes boo#1183125 'Leap 15.3 installation in Virtualbox without VBox integration'\n  Fixes CVE-2021-2264 and boo#1184542. The directory for the \u003cuser\u003e.start files for\n  autostarting VMs is moved from /etc/vbox to /etc/vbox/autostart.d. In addition, the autostart\n  service is hardened (by Oracle).\n-  change the modalias for guest-tools and guest-x11 to get them to autoinstall.\n- Own %{_sysconfdir}/X11/xinit/xinitrc.d as default packages (eg \n  systemd) no longer do so, breaking package build.\n- Update fixes_for_leap15.3 for kernel API changes between 5.3.18-45 and 5.3.18-47.\n- update-extpack.sh: explicitly use https:// protocol for authenticity. The\n  http:// URL is currently redirected to https:// but don't rely on this.\n- Add code to generate guest modules for Leap 15.2 and Leap 15.3. The kernel versions\n  do not allow window resizing. Files 'virtualbox-kmp-files-leap' and\n  'vboxguestconfig.sh' are added\n- Fixes CVE-2021-2074, boo#1181197 and CVE-2021-2129, boo#1181198.\n- Under some circumstances, shared folders are mounted as root. \n","modified":"2026-02-04T04:10:45.398743Z","published":"2021-04-30T19:22:36Z","related":["CVE-2021-2074","CVE-2021-2129","CVE-2021-2264"],"upstream":["CVE-2021-2074","CVE-2021-2129","CVE-2021-2264"],"references":[{"type":"ADVISORY","url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/2RTNW7ZRCP2VD6YMPAHFC7MY4YIB5GTL/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1181197"},{"type":"REPORT","url":"https://bugzilla.suse.com/1181198"},{"type":"REPORT","url":"https://bugzilla.suse.com/1183125"},{"type":"REPORT","url":"https://bugzilla.suse.com/1183329"},{"type":"REPORT","url":"https://bugzilla.suse.com/1184542"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2021-2074"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2021-2129"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2021-2264"}],"affected":[{"package":{"name":"virtualbox","ecosystem":"openSUSE:Leap 15.2","purl":"pkg:rpm/opensuse/virtualbox&distro=openSUSE%20Leap%2015.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.20-lp152.2.21.1"}]}],"ecosystem_specific":{"binaries":[{"virtualbox-guest-desktop-icons":"6.1.20-lp152.2.21.1","virtualbox-guest-source":"6.1.20-lp152.2.21.1","virtualbox-guest-x11":"6.1.20-lp152.2.21.1","virtualbox-kmp-default":"6.1.20_k5.3.18_lp152.72-lp152.2.21.1","virtualbox-websrv":"6.1.20-lp152.2.21.1","python3-virtualbox":"6.1.20-lp152.2.21.1","virtualbox-devel":"6.1.20-lp152.2.21.1","virtualbox-guest-tools":"6.1.20-lp152.2.21.1","virtualbox-host-source":"6.1.20-lp152.2.21.1","virtualbox-kmp-preempt":"6.1.20_k5.3.18_lp152.72-lp152.2.21.1","virtualbox-qt":"6.1.20-lp152.2.21.1","virtualbox-vnc":"6.1.20-lp152.2.21.1","virtualbox":"6.1.20-lp152.2.21.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2021:0630-1.json"}},{"package":{"name":"virtualbox-kmp","ecosystem":"openSUSE:Leap 15.2","purl":"pkg:rpm/opensuse/virtualbox-kmp&distro=openSUSE%20Leap%2015.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.20-lp152.2.21.1"}]}],"ecosystem_specific":{"binaries":[{"virtualbox-guest-source":"6.1.20-lp152.2.21.1","virtualbox-guest-tools":"6.1.20-lp152.2.21.1","virtualbox-host-source":"6.1.20-lp152.2.21.1","virtualbox-qt":"6.1.20-lp152.2.21.1","virtualbox":"6.1.20-lp152.2.21.1","virtualbox-devel":"6.1.20-lp152.2.21.1","virtualbox-guest-desktop-icons":"6.1.20-lp152.2.21.1","virtualbox-guest-x11":"6.1.20-lp152.2.21.1","virtualbox-kmp-default":"6.1.20_k5.3.18_lp152.72-lp152.2.21.1","virtualbox-kmp-preempt":"6.1.20_k5.3.18_lp152.72-lp152.2.21.1","virtualbox-vnc":"6.1.20-lp152.2.21.1","virtualbox-websrv":"6.1.20-lp152.2.21.1","python3-virtualbox":"6.1.20-lp152.2.21.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2021:0630-1.json"}}],"schema_version":"1.7.3"}