[SECURITY] [DLA 313-1] virtualbox-ose security update

2015-09-29T14:59:32
ID DEBIAN:DLA-313-1:41A72
Type debian
Reporter Debian
Modified 2015-09-29T14:59:32

Description

Package : virtualbox-ose Version : 3.2.28-dfsg-1+squeeze1 CVE ID : CVE-2013-3792 CVE-2014-2486 CVE-2014-2488 CVE-2014-2489 CVE-2015-2594 Bugs : #715327 #754939 #792446

The latest maintenance release of the VirtualBox (OSE) 3.2.x series (i.e., version 3.2.28) has been uploaded to Debian LTS (squeeze). Thanks to Gianfranco Costamagna for preparing packages for review and upload by the Debian LTS Team.

Unfortunately, Oracle no longer provides information on specific security vulnerabilities in VirtualBox, thus we provide their latest 3.2.28 maintenance release in Debian LTS (squeeze) directly.

CVE-2013-3792

Oracle reported an unspecified vulnerability in the Oracle VM
VirtualBox component in Oracle Virtualization VirtualBox prior to
3.2.18, 4.0.20, 4.1.28, and 4.2.18 allows local users to affect
availability via unknown vectors related to Core.

The fix for CVE-2013-3792 prevents a virtio-net host DoS
vulnerability by adding large frame support to IntNet, VirtioNet and
NetFilter plus dropping oversized frames.

CVE-2014-2486

Unspecified vulnerability in the Oracle VM VirtualBox component
in Oracle Virtualization VirtualBox before 3.2.24, 4.0.26,
4.1.34, 4.2.26, and 4.3.12 allows local users to affect integrity
and availability via unknown vectors related to Core.

No further details have been provided, the attack range has been
given as local, severity low.

CVE-2014-2488

Unspecified vulnerability in the Oracle VM VirtualBox component in
Oracle Virtualization VirtualBox before 3.2.24, 4.0.26, 4.1.34,
4.2.26, and 4.3.12 allows local users to affect confidentiality via
unknown vectors related to Core.

No further details can been provided, the attack range has been
given as local, severity low.

CVE-2014-2489

Unspecified vulnerability in the Oracle VM VirtualBox component in
Oracle Virtualization VirtualBox before 3.2.24, 4.0.26, 4.1.34,
4.2.26, and 4.3.12 allows local users to affect confidentiality,
integrity, and availability via unknown vectors related to Core.

No further details can been provided, the attack range has been
given as local, severity medium.

CVE-2015-2594

Unspecified vulnerability in the Oracle VM VirtualBox component            
in Oracle Virtualization VirtualBox prior to 4.0.32, 4.1.40,        
4.2.32, and 4.3.30 allows local users to affect confidentiality,        
integrity, and availability via unknown vectors related to Core.

This update fixes an issue related to guests using bridged networking
via WiFi.

--

mike gabriel aka sunweaver (Debian Developer) fon: +49 (1520) 1976 148

GnuPG Fingerprint: 9BFB AEE8 6C0A A5FF BF22 0782 9AF4 6B30 2577 1B31 mail: sunweaver@debian.org, http://sunweavers.net

Attachment: signature.asc Description: Digital signature