Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 3.2.26, 4.0.28, 4.1.36, and 4.2.28 allows local users to affect availability via unknown vectors related to Core, a different vulnerability than CVE-2015-0377.

The remote host is affected by the vulnerability described in GLSA-201612-27 (VirtualBox: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in VirtualBox. Please       review the CVE identifiers referenced below for details.
  Impact :

    Local attackers could cause a Denial of Service condition, execute       arbitrary code, or escalate their privileges.
  Workaround :

    There is no known workaround at this time.

Three vulnerabilities have been fixed in the Debian squeeze-lts version of VirtualBox (package name: virtualbox-ose), a x86 virtualisation solution.

CVE-2015-0377

Avoid VirtualBox allowing local users to affect availability via unknown vectors related to Core, which might result in denial of service. (Other issue than CVE-2015-0418).

CVE-2015-0418

Avoid VirtualBox allowing local users to affect availability via unknown vectors related to Core, which might result in denial of service. (Other issue than CVE-2015-0377).

CVE-2015-3456

The Floppy Disk Controller (FDC) in QEMU, also used in VirtualBox and other virtualization products, allowed local guest users to cause a denial of service (out-of-bounds write and guest crash) or possibly execute arbitrary code via the (1) FD_CMD_READ_ID, (2) FD_CMD_DRIVE_SPECIFICATION_COMMAND, or other unspecified commands, aka VENOM.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

virtualbox was updated to version 4.2.28 to fix eight security issues.

These security issues were fixed :

  - OpenSSL fixes for VirtualBox (CVE-2014-0224)

  - Unspecified vulnerability in the Oracle VM VirtualBox     prior to 3.2.26, 4.0.28, 4.1.36, and 4.2.28 allows local     users to affect availability via unknown vectors related     to Core, a different vulnerability than CVE-2015-0418     (CVE-2015-0377, bnc#914447).

  - Unspecified vulnerability in the Oracle VM VirtualBox     before 4.3.20 allows local users to affect integrity and     availability via vectors related to VMSVGA virtual     graphics device, a different vulnerability than     CVE-2014-6588, CVE-2014-6589, CVE-2014-6590, and     CVE-2015-0427 (CVE-2014-6595, bnc#914447).

  - Unspecified vulnerability in the Oracle VM VirtualBox     before 4.3.20 allows local users to affect integrity and     availability via vectors related to VMSVGA virtual     graphics device, a different vulnerability than     CVE-2014-6589, CVE-2014-6590, CVE-2014-6595, and     CVE-2015-0427 (CVE-2014-6588, bnc#914447).

  - Unspecified vulnerability in the Oracle VM VirtualBox     before 4.3.20 allows local users to affect integrity and     availability via vectors related to VMSVGA virtual     graphics device, a different vulnerability than     CVE-2014-6588, CVE-2014-6590, CVE-2014-6595, and     CVE-2015-0427 (CVE-2014-6589, bnc#914447).

  - Unspecified vulnerability in the Oracle VM VirtualBox     before 4.3.20 allows local users to affect integrity and     availability via vectors related to VMSVGA virtual     graphics device, a different vulnerability than     CVE-2014-6588, CVE-2014-6589, CVE-2014-6595, and     CVE-2015-0427 (CVE-2014-6590, bnc#914447).

  - Unspecified vulnerability in the Oracle VM VirtualBox     prior to 4.3.20 allows local users to affect integrity     and availability via vectors related to VMSVGA virtual     graphics device, a different vulnerability than     CVE-2014-6588, CVE-2014-6589, CVE-2014-6590, and     CVE-2014-6595 (CVE-2015-0427, bnc#914447).

  - Unspecified vulnerability in the Oracle VM VirtualBox     prior to 3.2.26, 4.0.28, 4.1.36, and 4.2.28 allows local     users to affect availability via unknown vectors related     to Core, a different vulnerability than CVE-2015-0377     (CVE-2015-0418, bnc#914447).

For the full changelog please read https://www.virtualbox.org/wiki/Changelog-4.2

Two vulnerabilities have been discovered in VirtualBox, a x86 virtualisation solution, which might result in denial of service.

The remote host contains a version of Oracle VM VirtualBox that is prior to 3.2.26 / 4.0.28 / 4.1.36 / 4.2.28 / 4.3.20. It is, therefore, affected by multiple vulnerabilities in the following subcomponents :
  - Core
  - OpenSSL
  - VMSVGA device

ID	Name	Product	Family	Severity
95695	GLSA-201612-27 : VirtualBox: Multiple vulnerabilities (Venom)	Nessus	Gentoo Local Security Checks	medium
84551	Debian DLA-268-1 : virtualbox-ose security update (Venom)	Nessus	Debian Local Security Checks	high
81242	openSUSE Security Update : virtualbox (openSUSE-2015-116)	Nessus	SuSE Local Security Checks	high
81056	Debian DSA-3143-1 : virtualbox - security update	Nessus	Debian Local Security Checks	medium
80915	Oracle VM VirtualBox < 3.2.26 / 4.0.28 / 4.1.36 / 4.2.28 / 4.3.20 Multiple Vulnerabilities (January 2015 CPU)	Nessus	Windows	medium

Detections

Analytics

CVE-2015-0418

medium

Tenable Plugins

medium

high

high

medium

medium