Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 4.0.32, 4.1.40, 4.2.32, and 4.3.30 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Core.

The latest maintenance release of the VirtualBox (OSE) 3.2.x series (i.e., version 3.2.28) has been uploaded to Debian LTS (squeeze).
Thanks to Gianfranco Costamagna for preparing packages for review and upload by the Debian LTS Team.

Unfortunately, Oracle no longer provides information on specific security vulnerabilities in VirtualBox, thus we provide their latest 3.2.28 maintenance release in Debian LTS (squeeze) directly.

CVE-2013-3792

Oracle reported an unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 3.2.18, 4.0.20, 4.1.28, and 4.2.18 allows local users to affect availability via unknown vectors related to Core.

The fix for CVE-2013-3792 prevents a virtio-net host DoS vulnerability by adding large frame support to IntNet, VirtioNet and NetFilter plus dropping oversized frames.

CVE-2014-2486

Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox before 3.2.24, 4.0.26, 4.1.34, 4.2.26, and 4.3.12 allows local users to affect integrity and availability via unknown vectors related to Core.

No further details have been provided, the attack range has been given as local, severity low.

CVE-2014-2488

Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox before 3.2.24, 4.0.26, 4.1.34, 4.2.26, and 4.3.12 allows local users to affect confidentiality via unknown vectors related to Core.

No further details can been provided, the attack range has been given as local, severity low.

CVE-2014-2489

Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox before 3.2.24, 4.0.26, 4.1.34, 4.2.26, and 4.3.12 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Core.

No further details can been provided, the attack range has been given as local, severity medium.

CVE-2015-2594

Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 4.0.32, 4.1.40, 4.2.32, and 4.3.30 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Core.

This update fixes an issue related to guests using bridged networking via WiFi.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes an unspecified security issue in VirtualBox related to guests using bridged networking via WiFi. Oracle no longer provides information on specific security vulnerabilities in VirtualBox. To still support users of the already released Debian releases we've decided to update these to the respective 4.1.40 and 4.3.30 bugfix releases.

- Version bump to 4.2.32 bnc#938408 CVE-2015-2594

  - Storage: fixed a crash when taking snapshots (4.2.30     regression)

  - ExtPack: don't fail if the TMP directory contains     non-latin1 characters (bug #14159)

  - Main: implemented dedicated event processing queue

  - Linux hosts: fixed a bug which made the netfilter driver     ignore certain events (bug #12264) 

Also included from Version bump to 4.2.30 bnc#935900 CVE-2015-3456 :

  - Various small fixes here and there

  - Fix the multiinstall on kernel modules to avoid     conflicts bnc#925663

  - Drop smap.diff fails to apply to the latest release

The remote host contains a version of Oracle VM VirtualBox that is prior to 4.0.32 / 4.1.40 / 4.2.32 / 4.3.30. It is, therefore, affected by an unspecified vulnerability in the Core subcomponent

ID	Name	Product	Family	Severity
86195	Debian DLA-313-1 : virtualbox-ose security update	Nessus	Debian Local Security Checks	medium
85915	Debian DSA-3359-1 : virtualbox - security update	Nessus	Debian Local Security Checks	medium
85525	openSUSE Security Update : virtualbox (openSUSE-2015-550) (Venom)	Nessus	SuSE Local Security Checks	high
84799	Oracle VM VirtualBox < 4.0.32 / 4.1.40 / 4.2.32 / 4.3.30 Core Unspecified Vulnerability (July 2015 CPU)	Nessus	Misc.	medium

Detections

Analytics

CVE-2015-2594

high

Tenable Plugins

medium

medium

high

medium