Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox before 4.3.20 allows local users to affect integrity and availability via vectors related to VMSVGA virtual graphics device, a different vulnerability than CVE-2014-6588, CVE-2014-6590, CVE-2014-6595, and CVE-2015-0427.

The remote host is affected by the vulnerability described in GLSA-201612-27 (VirtualBox: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in VirtualBox. Please       review the CVE identifiers referenced below for details.
  Impact :

    Local attackers could cause a Denial of Service condition, execute       arbitrary code, or escalate their privileges.
  Workaround :

    There is no known workaround at this time.

virtualbox was updated to version 4.2.28 to fix eight security issues.

These security issues were fixed :

  - OpenSSL fixes for VirtualBox (CVE-2014-0224)

  - Unspecified vulnerability in the Oracle VM VirtualBox     prior to 3.2.26, 4.0.28, 4.1.36, and 4.2.28 allows local     users to affect availability via unknown vectors related     to Core, a different vulnerability than CVE-2015-0418     (CVE-2015-0377, bnc#914447).

  - Unspecified vulnerability in the Oracle VM VirtualBox     before 4.3.20 allows local users to affect integrity and     availability via vectors related to VMSVGA virtual     graphics device, a different vulnerability than     CVE-2014-6588, CVE-2014-6589, CVE-2014-6590, and     CVE-2015-0427 (CVE-2014-6595, bnc#914447).

  - Unspecified vulnerability in the Oracle VM VirtualBox     before 4.3.20 allows local users to affect integrity and     availability via vectors related to VMSVGA virtual     graphics device, a different vulnerability than     CVE-2014-6589, CVE-2014-6590, CVE-2014-6595, and     CVE-2015-0427 (CVE-2014-6588, bnc#914447).

  - Unspecified vulnerability in the Oracle VM VirtualBox     before 4.3.20 allows local users to affect integrity and     availability via vectors related to VMSVGA virtual     graphics device, a different vulnerability than     CVE-2014-6588, CVE-2014-6590, CVE-2014-6595, and     CVE-2015-0427 (CVE-2014-6589, bnc#914447).

  - Unspecified vulnerability in the Oracle VM VirtualBox     before 4.3.20 allows local users to affect integrity and     availability via vectors related to VMSVGA virtual     graphics device, a different vulnerability than     CVE-2014-6588, CVE-2014-6589, CVE-2014-6595, and     CVE-2015-0427 (CVE-2014-6590, bnc#914447).

  - Unspecified vulnerability in the Oracle VM VirtualBox     prior to 4.3.20 allows local users to affect integrity     and availability via vectors related to VMSVGA virtual     graphics device, a different vulnerability than     CVE-2014-6588, CVE-2014-6589, CVE-2014-6590, and     CVE-2014-6595 (CVE-2015-0427, bnc#914447).

  - Unspecified vulnerability in the Oracle VM VirtualBox     prior to 3.2.26, 4.0.28, 4.1.36, and 4.2.28 allows local     users to affect availability via unknown vectors related     to Core, a different vulnerability than CVE-2015-0377     (CVE-2015-0418, bnc#914447).

For the full changelog please read https://www.virtualbox.org/wiki/Changelog-4.2

The remote host contains a version of Oracle VM VirtualBox that is prior to 3.2.26 / 4.0.28 / 4.1.36 / 4.2.28 / 4.3.20. It is, therefore, affected by multiple vulnerabilities in the following subcomponents :
  - Core
  - OpenSSL
  - VMSVGA device

ID	Name	Product	Family	Severity
95695	GLSA-201612-27 : VirtualBox: Multiple vulnerabilities (Venom)	Nessus	Gentoo Local Security Checks	medium
81242	openSUSE Security Update : virtualbox (openSUSE-2015-116)	Nessus	SuSE Local Security Checks	high
80915	Oracle VM VirtualBox < 3.2.26 / 4.0.28 / 4.1.36 / 4.2.28 / 4.3.20 Multiple Vulnerabilities (January 2015 CPU)	Nessus	Windows	medium

Detections

Analytics

CVE-2014-6589

high

Tenable Plugins

medium

high

medium