The recently declared CVEs for VBox have fixes mentioned only in the
4.3.20 release.

Debian Jessie is frozen, and for it, we have targeted the 4.3.18
release. Do you have the broken out patches that fix the vulnerabilities ?
--- Begin Message ---
On 01/21/2015 12:53 PM, Moritz Muehlenhoff wrote:
> Package: virtualbox
> Severity: grave
> Tags: security
> Justification: user security hole
>
> No specific details available yet:
> http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
>
> Cheers,
>         Moritz
>

The following matrix is what I could grab.

http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html#AppendixOVIR

CVE-2014-6595   Oracle VM VirtualBox    None    VMSVGA device   No      3.2
Local   Low     Single  None    Partial+        Partial+        VirtualBox 
prior to
4.3.20  See Note 3
CVE-2014-6588   Oracle VM VirtualBox    None    VMSVGA device   No      3.2
Local   Low     Single  None    Partial+        Partial+        VirtualBox 
prior to
4.3.20  See Note 3
CVE-2014-6589   Oracle VM VirtualBox    None    VMSVGA device   No      3.2
Local   Low     Single  None    Partial+        Partial+        VirtualBox 
prior to
4.3.20  See Note 3
CVE-2014-6590   Oracle VM VirtualBox    None    VMSVGA device   No      3.2
Local   Low     Single  None    Partial+        Partial+        VirtualBox 
prior to
4.3.20  See Note 3
CVE-2015-0427   Oracle VM VirtualBox    None    VMSVGA device   No      3.2
Local   Low     Single  None    Partial+        Partial+        VirtualBox 
prior to
4.3.20  See Note 3
CVE-2015-0418   Oracle VM VirtualBox    None    Core    No      2.1     Local   
Low
None    None    None    Partial+        VirtualBox prior to 3.2.26, 4.0.28, 
4.1.36,
4.2.28   

 

 

*Notes:*

 1. This fix also addresses CVE-2014-0231, CVE-2014-0118 and CVE-2014-5704.
 2. This fix also addresses CVE-2014-0221, CVE-2014-0195, CVE-2014-0198,
    CVE-2010-5298, CVE-2014-3470 and CVE-2014-0076.
 3. VMSVGA virtual graphics device is not documented and is disabled by
    default.



@Moritz: There's nothing more detailed than the statement that all
versions proior to 4.3.20 are vulnerable.
4.3.20 is in experimental right now.


-- 
Ritesh Raj Sarraf
RESEARCHUT - http://www.researchut.com
"Necessity is the mother of invention."

Attachment: signature.asc
Description: OpenPGP digital signature


--- End Message ---

Attachment: signature.asc
Description: OpenPGP digital signature

_______________________________________________
vbox-dev mailing list
[email protected]
https://www.virtualbox.org/mailman/listinfo/vbox-dev

Reply via email to