Login
Newsletter
Werbung

Sicherheit: Mehrere Probleme in virtualbox
Aktuelle Meldungen Distributionen
Name: Mehrere Probleme in virtualbox
ID: openSUSE-SU-2018:2295-1
Distribution: SUSE
Plattformen: SUSE openSUSE Leap 15.0
Datum: Fr, 10. August 2018, 07:13
Referenzen: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3091
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3090
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3089
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3085
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3005
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3086
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3055
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3088
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3087
Applikationen: VirtualBox

Originalnachricht

   openSUSE Security Update: Security update for virtualbox
______________________________________________________________________________

Announcement ID: openSUSE-SU-2018:2295-1
Rating: important
References: #1101667
Cross-References: CVE-2018-3005 CVE-2018-3055 CVE-2018-3085
CVE-2018-3086 CVE-2018-3087 CVE-2018-3088
CVE-2018-3089 CVE-2018-3090 CVE-2018-3091

Affected Products:
openSUSE Leap 15.0
______________________________________________________________________________

An update that fixes 9 vulnerabilities is now available.

Description:

This update for virtualbox to version 5.2.16 fixes the following issues:

The following security vulnerabilities were fixed (boo#1101667):

- CVE-2018-3005: Fixed an easily exploitable vulnerability that allowed
unauthenticated attacker with logon to the infrastructure where Oracle
VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful
attacks of this vulnerability can result in unauthorized ability to
cause a partial denial
of service (partial DOS) of Oracle VM VirtualBox.

- CVE-2018-3055: Fixed an easily exploitable vulnerability that allowed
unauthenticated attacker with logon to the infrastructure where Oracle
VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful
attacks require human interaction from a person other than the attacker
and while the vulnerability is in Oracle VM VirtualBox, attacks may
significantly impact additional products. Successful attacks of this
vulnerability can result in unauthorized ability to cause a hang or
frequently repeatable crash (complete DOS) of Oracle VM VirtualBox and
unauthorized read access to a subset of Oracle VM VirtualBox accessible
data.

- CVE-2018-3085: Fixed an easily exploitable vulnerability that allowed
unauthenticated attacker with logon to the infrastructure where Oracle
VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful
attacks require human interaction from a person other than the attacker
and while the vulnerability is in Oracle VM VirtualBox, attacks may
significantly impact additional products. Successful attacks of this
vulnerability can result in unauthorized creation, deletion or
modification access to critical data or all Oracle VM VirtualBox
accessible data as well as unauthorized read access to a subset of
Oracle VM VirtualBox accessible data and unauthorized ability to cause a
hang or frequently repeatable crash (complete DOS) of Oracle VM
VirtualBox.

- CVE-2018-3086: Fixed an easily exploitable vulnerability that allowed
unauthenticated attacker with logon to the infrastructure where Oracle
VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful
attacks require human interaction from a person other than the attacker
and while the vulnerability is in Oracle VM VirtualBox, attacks may
significantly impact additional products. Successful attacks of this
vulnerability can result in takeover of Oracle VM VirtualBox.

- CVE-2018-3087: Fixed an easily exploitable vulnerability that allowed
unauthenticated attacker with logon to the infrastructure where Oracle
VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful
attacks require human interaction from a person other than the attacker
and while the vulnerability is in Oracle VM VirtualBox, attacks may
significantly impact additional products. Successful attacks of this
vulnerability can result in takeover of Oracle VM VirtualBox.

- CVE-2018-3088: Fixed an easily exploitable vulnerability allows
unauthenticated attacker with logon to the infrastructure where Oracle
VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful
attacks require human interaction from a person other than the attacker
and while the vulnerability is in Oracle VM VirtualBox, attacks may
significantly impact additional products. Successful attacks of this
vulnerability can result in takeover of Oracle VM VirtualBox.

- CVE-2018-3089: Fixed an easily exploitable vulnerability allows
unauthenticated attacker with logon to the infrastructure where Oracle
VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful
attacks require human interaction from a person other than the attacker
and while the vulnerability is in Oracle VM VirtualBox, attacks may
significantly impact additional products. Successful attacks of this
vulnerability can result in takeover of Oracle VM VirtualBox.

- CVE-2018-3090: Fixed an easily exploitable vulnerability allows
unauthenticated attacker with logon to the infrastructure where Oracle
VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful
attacks require human interaction from a person other than the attacker
and while the vulnerability is in Oracle VM VirtualBox, attacks may
significantly impact additional products. Successful attacks of this
vulnerability can result in takeover of Oracle VM VirtualBox.

- CVE-2018-3091: Fixed an easily exploitable vulnerability allows
unauthenticated attacker with logon to the infrastructure where Oracle
VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful
attacks require human interaction from a person other than the attacker
and while the vulnerability is in Oracle VM VirtualBox, attacks may
significantly impact additional products. Successful attacks of this
vulnerability can result in unauthorized access to critical data or
complete access to all Oracle VM VirtualBox accessible data.

The following bugs were fixed:

- OVF: case insensitive comparison of manifest attribute values, to
improve compatibility


Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended
installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 15.0:

zypper in -t patch openSUSE-2018-853=1



Package List:

- openSUSE Leap 15.0 (x86_64):

python3-virtualbox-5.2.16-lp150.4.9.1
python3-virtualbox-debuginfo-5.2.16-lp150.4.9.1
virtualbox-5.2.16-lp150.4.9.1
virtualbox-debuginfo-5.2.16-lp150.4.9.1
virtualbox-debugsource-5.2.16-lp150.4.9.1
virtualbox-devel-5.2.16-lp150.4.9.1
virtualbox-guest-kmp-default-5.2.16_k4.12.14_lp150.12.7-lp150.4.9.1

virtualbox-guest-kmp-default-debuginfo-5.2.16_k4.12.14_lp150.12.7-lp150.4.9.1
virtualbox-guest-tools-5.2.16-lp150.4.9.1
virtualbox-guest-tools-debuginfo-5.2.16-lp150.4.9.1
virtualbox-guest-x11-5.2.16-lp150.4.9.1
virtualbox-guest-x11-debuginfo-5.2.16-lp150.4.9.1
virtualbox-host-kmp-default-5.2.16_k4.12.14_lp150.12.7-lp150.4.9.1

virtualbox-host-kmp-default-debuginfo-5.2.16_k4.12.14_lp150.12.7-lp150.4.9.1
virtualbox-qt-5.2.16-lp150.4.9.1
virtualbox-qt-debuginfo-5.2.16-lp150.4.9.1
virtualbox-vnc-5.2.16-lp150.4.9.1
virtualbox-websrv-5.2.16-lp150.4.9.1
virtualbox-websrv-debuginfo-5.2.16-lp150.4.9.1

- openSUSE Leap 15.0 (noarch):

virtualbox-guest-desktop-icons-5.2.16-lp150.4.9.1
virtualbox-guest-source-5.2.16-lp150.4.9.1
virtualbox-host-source-5.2.16-lp150.4.9.1


References:

https://www.suse.com/security/cve/CVE-2018-3005.html
https://www.suse.com/security/cve/CVE-2018-3055.html
https://www.suse.com/security/cve/CVE-2018-3085.html
https://www.suse.com/security/cve/CVE-2018-3086.html
https://www.suse.com/security/cve/CVE-2018-3087.html
https://www.suse.com/security/cve/CVE-2018-3088.html
https://www.suse.com/security/cve/CVE-2018-3089.html
https://www.suse.com/security/cve/CVE-2018-3090.html
https://www.suse.com/security/cve/CVE-2018-3091.html
https://bugzilla.suse.com/1101667

--
To unsubscribe, e-mail: opensuse-security-announce+unsubscribe@opensuse.org
For additional commands, e-mail: opensuse-security-announce+help@opensuse.org
Pro-Linux
Pro-Linux @Facebook
Neue Nachrichten
Werbung