Re: [vbox-dev] "Disgruntled Security Researcher Publishes Major VirtualBox 0-Day Exploit"

2018-11-12 Thread Michael Thayer
Hello Larry, It looks to me like the site was updated after 5.2.22 was released to say that the researcher considers the issue fixed. Unfortunately we are by Oracle policy to comment on security fixes or even mention them in the change log - all security information is published in the quarterly

Re: [vbox-dev] "Disgruntled Security Researcher Publishes Major VirtualBox 0-Day Exploit"

2018-11-11 Thread Larry Finger
On 11/11/18 1:09 AM, Mihai Hanor wrote: Hi, According to the same researcher, Virtualbox 5.2.22 fixes the vulnerability: https://github.com/MorteNoir1/virtualbox_e1000_0day/issues/12 I'm not sure that he says that 5.2.22 fixes the problem. What he says is that 5.2.20 and earlier are

Re: [vbox-dev] "Disgruntled Security Researcher Publishes Major VirtualBox 0-Day Exploit"

2018-11-10 Thread Mihai Hanor
Hi, According to the same researcher, Virtualbox 5.2.22 fixes the vulnerability: https://github.com/MorteNoir1/virtualbox_e1000_0day/issues/12 Regards, Mihai On Sat, 10 Nov 2018, 23:26 Stéphane Charette This just hit Slashdot: "According to a text file uploaded on GitHub, > Saint

[vbox-dev] "Disgruntled Security Researcher Publishes Major VirtualBox 0-Day Exploit"

2018-11-10 Thread Stéphane Charette
This just hit Slashdot: "According to a text file uploaded on GitHub, Saint Petersburg-based researcher Sergey Zelenyuk has found a chain of bugs that can allow malicious code to escape the VirtualBox virtual machine (the guest OS) and execute on the underlying (host) operating system." One