The remote host contains a version of Oracle VM VirtualBox that is prior to 3.2.26 / 4.0.28 / 4.1.36 / 4.2.28 / 4.3.20. It is, therefore, affected by multiple vulnerabilities in the following subcomponents :
  - Core
  - OpenSSL
  - VMSVGA device

The remote host is affected by the vulnerability described in GLSA-201612-27 (VirtualBox: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in VirtualBox. Please       review the CVE identifiers referenced below for details.
  Impact :

    Local attackers could cause a Denial of Service condition, execute       arbitrary code, or escalate their privileges.
  Workaround :

    There is no known workaround at this time.

virtualbox was updated to version 4.2.28 to fix eight security issues.

These security issues were fixed :

  - OpenSSL fixes for VirtualBox (CVE-2014-0224)

  - Unspecified vulnerability in the Oracle VM VirtualBox     prior to 3.2.26, 4.0.28, 4.1.36, and 4.2.28 allows local     users to affect availability via unknown vectors related     to Core, a different vulnerability than CVE-2015-0418     (CVE-2015-0377, bnc#914447).

  - Unspecified vulnerability in the Oracle VM VirtualBox     before 4.3.20 allows local users to affect integrity and     availability via vectors related to VMSVGA virtual     graphics device, a different vulnerability than     CVE-2014-6588, CVE-2014-6589, CVE-2014-6590, and     CVE-2015-0427 (CVE-2014-6595, bnc#914447).

  - Unspecified vulnerability in the Oracle VM VirtualBox     before 4.3.20 allows local users to affect integrity and     availability via vectors related to VMSVGA virtual     graphics device, a different vulnerability than     CVE-2014-6589, CVE-2014-6590, CVE-2014-6595, and     CVE-2015-0427 (CVE-2014-6588, bnc#914447).

  - Unspecified vulnerability in the Oracle VM VirtualBox     before 4.3.20 allows local users to affect integrity and     availability via vectors related to VMSVGA virtual     graphics device, a different vulnerability than     CVE-2014-6588, CVE-2014-6590, CVE-2014-6595, and     CVE-2015-0427 (CVE-2014-6589, bnc#914447).

  - Unspecified vulnerability in the Oracle VM VirtualBox     before 4.3.20 allows local users to affect integrity and     availability via vectors related to VMSVGA virtual     graphics device, a different vulnerability than     CVE-2014-6588, CVE-2014-6589, CVE-2014-6595, and     CVE-2015-0427 (CVE-2014-6590, bnc#914447).

  - Unspecified vulnerability in the Oracle VM VirtualBox     prior to 4.3.20 allows local users to affect integrity     and availability via vectors related to VMSVGA virtual     graphics device, a different vulnerability than     CVE-2014-6588, CVE-2014-6589, CVE-2014-6590, and     CVE-2014-6595 (CVE-2015-0427, bnc#914447).

  - Unspecified vulnerability in the Oracle VM VirtualBox     prior to 3.2.26, 4.0.28, 4.1.36, and 4.2.28 allows local     users to affect availability via unknown vectors related     to Core, a different vulnerability than CVE-2015-0377     (CVE-2015-0418, bnc#914447).

For the full changelog please read https://www.virtualbox.org/wiki/Changelog-4.2

Two vulnerabilities have been discovered in VirtualBox, a x86 virtualisation solution, which might result in denial of service.

Three vulnerabilities have been fixed in the Debian squeeze-lts version of VirtualBox (package name: virtualbox-ose), a x86 virtualisation solution.

CVE-2015-0377

Avoid VirtualBox allowing local users to affect availability via unknown vectors related to Core, which might result in denial of service. (Other issue than CVE-2015-0418).

CVE-2015-0418

Avoid VirtualBox allowing local users to affect availability via unknown vectors related to Core, which might result in denial of service. (Other issue than CVE-2015-0377).

CVE-2015-3456

The Floppy Disk Controller (FDC) in QEMU, also used in VirtualBox and other virtualization products, allowed local guest users to cause a denial of service (out-of-bounds write and guest crash) or possibly execute arbitrary code via the (1) FD_CMD_READ_ID, (2) FD_CMD_DRIVE_SPECIFICATION_COMMAND, or other unspecified commands, aka VENOM.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
80915	Oracle VM VirtualBox < 3.2.26 / 4.0.28 / 4.1.36 / 4.2.28 / 4.3.20 Multiple Vulnerabilities (January 2015 CPU)	Nessus	Windows	1/22/2015	11/25/2019	medium
95695	GLSA-201612-27 : VirtualBox: Multiple vulnerabilities (Venom)	Nessus	Gentoo Local Security Checks	12/12/2016	1/11/2021	medium
81242	openSUSE Security Update : virtualbox (openSUSE-2015-116)	Nessus	SuSE Local Security Checks	2/9/2015	1/19/2021	high
81056	Debian DSA-3143-1 : virtualbox - security update	Nessus	Debian Local Security Checks	1/29/2015	1/11/2021	medium
84551	Debian DLA-268-1 : virtualbox-ose security update (Venom)	Nessus	Debian Local Security Checks	7/7/2015	1/11/2021	high

Detections

Analytics

Plugins Search

medium

medium

high

medium

high