Your message dated Sun, 31 May 2015 16:03:19 +0000
with message-id <[email protected]>
and subject line Bug#785424: fixed in virtualbox 4.1.18-dfsg-2+deb7u5
has caused the Debian Bug report #785424,
regarding virtualbox: CVE-2015-3456: floppy driver host code execution
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
785424: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=785424
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: virtualbox
Version: 4.1.18-dfsg-1
Severity: grave
Tags: security upstream fixed-upstream
Justification: user security hole
Hi,
the following vulnerability was published for virtualbox.
CVE-2015-3456[0]:
| The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and
| earlier and KVM, allows local guest users to cause a denial of service
| (out-of-bounds write and guest crash) or possibly execute arbitrary
| code via the (1) FD_CMD_READ_ID, (2)
| FD_CMD_DRIVE_SPECIFICATION_COMMAND, or other unspecified commands, aka
| VENOM.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2015-3456
[1]
http://www.oracle.com/technetwork/topics/security/alert-cve-2015-3456-2542656.html
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: virtualbox
Source-Version: 4.1.18-dfsg-2+deb7u5
We believe that the bug you reported is fixed in the latest version of
virtualbox, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Ritesh Raj Sarraf <[email protected]> (supplier of updated virtualbox package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.8
Date: Mon, 18 May 2015 18:32:20 +0200
Source: virtualbox
Binary: virtualbox-qt virtualbox virtualbox-dbg virtualbox-dkms
virtualbox-source virtualbox-guest-dkms virtualbox-guest-source
virtualbox-guest-x11 virtualbox-guest-utils virtualbox-fuse virtualbox-ose-qt
virtualbox-ose virtualbox-ose-dbg virtualbox-ose-dkms virtualbox-ose-source
virtualbox-ose-guest-dkms virtualbox-ose-guest-source virtualbox-ose-guest-x11
virtualbox-ose-guest-utils virtualbox-ose-fuse
Architecture: source amd64 all
Version: 4.1.18-dfsg-2+deb7u5
Distribution: wheezy-security
Urgency: medium
Maintainer: Debian Virtualbox Team
<[email protected]>
Changed-By: Ritesh Raj Sarraf <[email protected]>
Description:
virtualbox - x86 virtualization solution - base binaries
virtualbox-dbg - x86 virtualization solution - debugging symbols
virtualbox-dkms - x86 virtualization solution - kernel module sources for dkms
virtualbox-fuse - x86 virtualization solution - virtual filesystem
virtualbox-guest-dkms - x86 virtualization solution - guest addition module
source for dk
virtualbox-guest-source - x86 virtualization solution - guest addition module
source
virtualbox-guest-utils - x86 virtualization solution - non-X11 guest utilities
virtualbox-guest-x11 - x86 virtualization solution - X11 guest utilities
virtualbox-ose - transitional package for virtualbox
virtualbox-ose-dbg - transitional package for virtualbox-dbg
virtualbox-ose-dkms - transitional package for virtualbox-dkms
virtualbox-ose-fuse - transitional package for virtualbox-fuse
virtualbox-ose-guest-dkms - transitional package for virtualbox-guest-dkms
virtualbox-ose-guest-source - transitional package for virtualbox-guest-source
virtualbox-ose-guest-utils - transitional package for virtualbox-guest-utils
virtualbox-ose-guest-x11 - transitional package for virtualbox-guest-x11
virtualbox-ose-qt - transitional package for virtualbox-qt
virtualbox-ose-source - transitional package for virtualbox-source
virtualbox-qt - x86 virtualization solution - Qt based user interface
virtualbox-source - x86 virtualization solution - kernel module source
Closes: 785424
Changes:
virtualbox (4.1.18-dfsg-2+deb7u5) wheezy-security; urgency=medium
.
* d/p/CVE-2015-3456.patch fix for CVE-2015-3456 a.k.a. VENOM
(Closes: #785424)
Checksums-Sha1:
82ba2f50852829f117bb620839429f212cda13fb 4111
virtualbox_4.1.18-dfsg-2+deb7u5.dsc
0eccc381a7ed919b40c951ca88193654d0de162e 105589
virtualbox_4.1.18-dfsg-2+deb7u5.debian.tar.gz
abe425a97ae92cc8aa42b7a0a2185f48251cb03c 496306
virtualbox-dkms_4.1.18-dfsg-2+deb7u5_all.deb
c824a4015670aeb4ebb672fb0d173ace357b3cad 597328
virtualbox-source_4.1.18-dfsg-2+deb7u5_all.deb
bfec4dce750bd367be65bc81cbf7979eaf431ad3 434734
virtualbox-guest-dkms_4.1.18-dfsg-2+deb7u5_all.deb
5e6c32ab0dc984242dc12c25b983fb513563b490 530040
virtualbox-guest-source_4.1.18-dfsg-2+deb7u5_all.deb
3754004e9295d8fbaf9cd12d44d477c726fe2fd6 41488
virtualbox-ose-qt_4.1.18-dfsg-2+deb7u5_all.deb
57a43d0e615fdd35398bfdda753881ac4551c5a8 41480
virtualbox-ose_4.1.18-dfsg-2+deb7u5_all.deb
b8159496bdadc1b52b725b6b0dce8fc6c8cc4431 41490
virtualbox-ose-dbg_4.1.18-dfsg-2+deb7u5_all.deb
895adcd6aa9a1048bf0eedcaae72799499c11a81 41492
virtualbox-ose-dkms_4.1.18-dfsg-2+deb7u5_all.deb
d6c6863338f0ac4644f12ce560c6bd41a19db151 41492
virtualbox-ose-source_4.1.18-dfsg-2+deb7u5_all.deb
099257752b6e3e27742531b0f6fe4773ea3602e4 41502
virtualbox-ose-guest-dkms_4.1.18-dfsg-2+deb7u5_all.deb
cdbf01ec9683170b00c692214b60608d34963023 41502
virtualbox-ose-guest-source_4.1.18-dfsg-2+deb7u5_all.deb
1668bb7eaad1e93e385bf9f52c8fa536110587d8 41502
virtualbox-ose-guest-x11_4.1.18-dfsg-2+deb7u5_all.deb
45113ad15048ff7f010a7866a0ab66d3d5b5a67f 41502
virtualbox-ose-guest-utils_4.1.18-dfsg-2+deb7u5_all.deb
99d861968ecd398360e7a7ce42b11d49d23bcd5c 41490
virtualbox-ose-fuse_4.1.18-dfsg-2+deb7u5_all.deb
Checksums-Sha256:
04058adf7c4ca694c17138148e404c5d36cd682e8b238ecc886ad897c51f25a4 4111
virtualbox_4.1.18-dfsg-2+deb7u5.dsc
ce8603827ab2d9a6b3ea5be2a1c93a7420a187abb05db5af1c67627b84b442bc 105589
virtualbox_4.1.18-dfsg-2+deb7u5.debian.tar.gz
8729ef1a396ab17d361b42cb11b4a529ddb633c9282258df431041d6ca469764 496306
virtualbox-dkms_4.1.18-dfsg-2+deb7u5_all.deb
6ad46c07411e4ff4e4cd9dc505bb6f944b73936b8ba2702099287522be504e89 597328
virtualbox-source_4.1.18-dfsg-2+deb7u5_all.deb
be49285f2dc6952b9cab98e70e00ed58bb375e4d487bc7c4c2c1623e36167b68 434734
virtualbox-guest-dkms_4.1.18-dfsg-2+deb7u5_all.deb
45f1d8917c4259b76e8e4f2dab6ef4107e0e3a1aa1783a9947d6074d5e66f05e 530040
virtualbox-guest-source_4.1.18-dfsg-2+deb7u5_all.deb
ab93ec371b2c39d9684f7e276a500a38ce5c3c67db47d9cf136e2d806824a5b4 41488
virtualbox-ose-qt_4.1.18-dfsg-2+deb7u5_all.deb
cfbf88aa13e39a28d2adad2878ff486311f197e0a257a8d91ceb786db5fb900e 41480
virtualbox-ose_4.1.18-dfsg-2+deb7u5_all.deb
a454d580f57f682ff65f6b3f5699c9d4d26267ced8f9d59f279677b770e1bf0d 41490
virtualbox-ose-dbg_4.1.18-dfsg-2+deb7u5_all.deb
d01cafe40444465296dc70d1bb903517d714ad95f88a0a66b42d5168ee71fb9c 41492
virtualbox-ose-dkms_4.1.18-dfsg-2+deb7u5_all.deb
92e9c1b1237f77996905696528ee1230342290c06be43ff3726cdabf0033d4b6 41492
virtualbox-ose-source_4.1.18-dfsg-2+deb7u5_all.deb
af0ff33f5fc5246070a8930a608d25417535ec664b9e7fcbf9ff91e97f2cddfc 41502
virtualbox-ose-guest-dkms_4.1.18-dfsg-2+deb7u5_all.deb
31b9d4f1e5d7eeecd0516087eeb007eaa0443840ad6c63ed372d031150a273f0 41502
virtualbox-ose-guest-source_4.1.18-dfsg-2+deb7u5_all.deb
2b3522cbbeca142bfe9e38eb03ea12778e22a9638cd0ee2a08adcd4621dacde1 41502
virtualbox-ose-guest-x11_4.1.18-dfsg-2+deb7u5_all.deb
f449e3d8f8aa154f177063076deec6c37dcb9f5928d1087f331df053076456d0 41502
virtualbox-ose-guest-utils_4.1.18-dfsg-2+deb7u5_all.deb
239131df97aa02a98cd1c2a40d9c0f66e3faad8b9ac679ac0af7db106f5f6ed6 41490
virtualbox-ose-fuse_4.1.18-dfsg-2+deb7u5_all.deb
Files:
1b47558117facfa8aaf3375ef71495b1 4111 misc optional
virtualbox_4.1.18-dfsg-2+deb7u5.dsc
3c7c875cfd62fceaa725dc91b11666cf 105589 misc optional
virtualbox_4.1.18-dfsg-2+deb7u5.debian.tar.gz
3765bd8fcaafb111390c8f6cf3c0c5a6 496306 kernel optional
virtualbox-dkms_4.1.18-dfsg-2+deb7u5_all.deb
4440b49da20eb7e2517dad68f2fe7a89 597328 kernel optional
virtualbox-source_4.1.18-dfsg-2+deb7u5_all.deb
66088ad784bec3e2cf98fa4ea80982ad 434734 kernel optional
virtualbox-guest-dkms_4.1.18-dfsg-2+deb7u5_all.deb
ef7e3429521faaf702e5e79b65c1c9aa 530040 kernel optional
virtualbox-guest-source_4.1.18-dfsg-2+deb7u5_all.deb
8eb6c86e263e4369054a98e9363e6082 41488 oldlibs extra
virtualbox-ose-qt_4.1.18-dfsg-2+deb7u5_all.deb
69b536c07ba76868e5a80d8e865d1b7f 41480 oldlibs extra
virtualbox-ose_4.1.18-dfsg-2+deb7u5_all.deb
8296502b3a215984a61f42583de98d4e 41490 oldlibs extra
virtualbox-ose-dbg_4.1.18-dfsg-2+deb7u5_all.deb
02869a7e97cda4ff9614135fe91e01dc 41492 oldlibs extra
virtualbox-ose-dkms_4.1.18-dfsg-2+deb7u5_all.deb
5736e72250fb465242e0a428e018128a 41492 oldlibs extra
virtualbox-ose-source_4.1.18-dfsg-2+deb7u5_all.deb
f351af3fb93b6e678a88d90356db78ee 41502 oldlibs extra
virtualbox-ose-guest-dkms_4.1.18-dfsg-2+deb7u5_all.deb
142e639344715ab7c8b19ad24fadb2e5 41502 oldlibs extra
virtualbox-ose-guest-source_4.1.18-dfsg-2+deb7u5_all.deb
e3e50a89b061da543fd9874b0f23ce54 41502 oldlibs extra
virtualbox-ose-guest-x11_4.1.18-dfsg-2+deb7u5_all.deb
42407daf167ed862d13bf5798def9040 41502 oldlibs extra
virtualbox-ose-guest-utils_4.1.18-dfsg-2+deb7u5_all.deb
8c154a184e4e205fbec3fdc6d4dd0969 41490 oldlibs extra
virtualbox-ose-fuse_4.1.18-dfsg-2+deb7u5_all.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAEBAgAGBQJVXuFDAAoJEKY6WKPy4XVpSl0QAJz7nAu4DCOCMIupKTgfuphe
VAKNLTwGdefXmkeNSWRm0D5kTAKbz4TChtL6q6lgQ+AqFlK01MjpP+lA8coBE0Dd
nRM63X+9Mm0PsYYIwtu42PY7Dd28brP7Y5jRlBXRs0G5jJ0BEqJCEPV2L4WcTzT5
JwrK3ST7OZsWge2DK+bijzagXmvierHTwSkdeyU4jR1ug5NZNUI5D2vT2qqlhdwn
ngG8Y9B2z/RhnvZ2dG8CTv5nkBWuFf3cywzTmxXlR1Lj7amBZo7Pkiz8wijW5Ecl
waFjnx7VejKwAnoX/N2Rn0pD5esgm/ptU5vWQu+9FgTSYXInGeO7KYnkNt+LJuTB
TsHWh8OGBYI/Oqs/Lsfz1Vn4e4Gh5Lt9WMbGglAdizq54rEjdfJiGaJJTzEec71J
YHJWoi7h03859XUuS7tLXtBqPtW2kG6JnE9Od3NZ8cj/m322J8/1P3ePHPPdSwYi
2bK4TAfEGIjld8i/nOS8+3DrBJxKyDixfYztMOOgdOuPJHrnyql0bqRqyuVHUHVY
NGfQH1JtPA1vyCKysG/U36Pp1/LQtoXmgUt6vBhqPHBV/U1DkdNSq4DuTnl9ed0N
46jpr4vamMbf6+bHNIF0EUQmqBjKA3C99pl0PMXD/QgKVuCEqE0ndU21MDuCpQxZ
0T0WASIzcElDuAj5uJc8
=Fkan
-----END PGP SIGNATURE-----
--- End Message ---
