Detections
Analytics
Oracle VM VirtualBox < 4.0.36 / 4.1.44 / 4.2.36 / 4.3.34 / 5.0.10 Multiple Vulnerabilities (January 2016 CPU)
high Nessus Plugin ID 88051
Language:
Synopsis
An application installed on the remote host is affected by multiple vulnerabilities.Description
The Oracle VM VirtualBox application installed on the remote host is a version prior to 4.0.36, 4.1.44, 4.2.36, 4.3.34, or 5.0.10. It is, therefore, affected by the following vulnerabilities :- A denial of service vulnerability exists due to an infinite loop condition in the KVM subsystem of the Linux kernel. A local attacker can exploit this, by triggering many Alignment Check (#AC) exceptions, to cause an OS panic or hang. (CVE-2015-5307)
- A integer overflow condition exists in the PL_ARENA_ALLOCATE implementation in Netscape Portable Runtime (NSPR) due to a failure to properly validate user-supplied input during memory allocation. A remote attacker can exploit this to corrupt memory, resulting in a denial of service or execution of arbitrary code.
(CVE-2015-7183)
- A denial of service vulnerability exists due to an infinite loop condition in the KVM subsystem of the Linux kernel. A local attacker can exploit this, by triggering many Debug (#DB) exceptions, to cause an OS panic or hang.
(CVE-2015-8104)
Solution
Upgrade to Oracle VM VirtualBox version 4.0.36 / 4.1.44 / 4.2.36 / 4.3.34 / 5.0.10 or later as referenced in the January 2016 Oracle Critical Patch Update advisory.See Also
Plugin Details
Severity: High
ID: 88051
File Name: virtualbox_5_0_10.nasl
Version: 1.5
Type: local
Agent: windows, macosx, unix
Family: Misc.
Published: 1/21/2016
Updated: 11/15/2018
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.5
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 5.5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS Score Source: CVE-2015-7183
Vulnerability Information
CPE: cpe:/a:oracle:vm_virtualbox
Exploit Ease: No known exploits are available
Patch Publication Date: 1/19/2016
Vulnerability Publication Date: 10/15/2015