Security update for virtualbox (moderate)

2022-09-1600:00:00

lists.opensuse.org

8.2 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

JSON

An update that fixes two vulnerabilities is now available.

Description:

This update for virtualbox fixes the following issues:

Remove package virtualbox-guest-x11, which is no longer needed.
Fix screen resizing under Wayland (boo#1194126 and boo#1194126)

Version bump to 6.1.36 released by Oracle July 19 2022

This is a maintenance release. The following items were fixed and/or added:

VMM: Fixed possible Linux guest kernel crash when configuring
Speculative Store Bypass for a single vCPU VM
GUI: In the storage page of the virtual machine settings dialog, fixed a
bug which disrupted mouse interaction with the native file selector on
KDE
NAT: Prevent issue when host resolver incorrectly returned NXDOMAIN for
unsupported queries (bug #20977)
Audio: General improvements in saved state area
Recording: Various fixes for settings handling
VGA: Performance improvements for screen updates when VBE banking is used
USB: Fixed rare crashes when detaching a USB device
ATA: Fixed NT4 guests taking a minute to eject CDs
vboximg-mount: Fixed broken write support (bug #20896)
SDK: Fixed Python bindings incorrectly trying to convert arbitrary byte
data into unicode objects with Python 3, causing exceptions (bug #19740)
API: Fixed an issue when virtual USB mass storage devices or virtual USB
DVD drives are added while the VM is not running are by default not
marked as hot-pluggable
API: Initial support for Python 3.10
API: Solaris OS types cleanup
Linux and Solaris hosts: Allow to mount shared folder if it is
represented as a symlink on a host side (bug #17491)
Linux Host and Guest drivers: Introduced initial support for kernels
5.18, 5.19 and RHEL 9.1 (bugs #20914, #20941)
Linux Host and Guest drivers: Better support for kernels built with
clang compiler (bugs #20425 and #20998)
Solaris Guest Additions: General improvements in installer area
Solaris Guest Additions: Fixed guest screen resize in VMSVGA graphics
configuration
Linux and Solaris Guest Additions: Fixed multi-screen handling in
VBoxVGA and VBoxSVGA graphics configuration
Linux and Solaris Guest Additions: Added support for setting primary
screen via VBoxManage
Linux and Solaris Guest Additions: Fixed X11 resources leak when
resizing guest screens
Linux and Solaris Guest Additions: Fixed file descriptor leak when
starting a process using guest control (bug #20902)
Linux and Solaris Guest Additions: Fixed guest control executing
processes as root
Linux Guest Additions: Improved guests booting time by preventing kernel
modules from being rebuilt when it is not necessary (bug #20502)
Windows Guest Additions: Fixed VBoxTray crash on startup in NT4 guests
on rare circumstances
Fixes CVE-2022-21571) VUL-0: CVE-2022-21571,CVE-2022-21554 - boo#1201720

Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or “zypper patch”.

Alternatively you can run the command listed for your product:

openSUSE Leap 15.3:

zypper in -t patch openSUSE-2022-10122=1

OSVersionArchitecturePackageVersionFilename
openSUSE Leap15.3x86_64< - openSUSE Leap 15.3 (x86_64):- openSUSE Leap 15.3 (x86_64):.x86_64.rpm
openSUSE Leap15.3noarch< - openSUSE Leap 15.3 (noarch):- openSUSE Leap 15.3 (noarch):.noarch.rpm

OS	Version	Architecture	Package	Version	Filename
openSUSE Leap	15.3	x86_64		< - openSUSE Leap 15.3 (x86_64):	- openSUSE Leap 15.3 (x86_64):.x86_64.rpm
openSUSE Leap	15.3	noarch		< - openSUSE Leap 15.3 (noarch):	- openSUSE Leap 15.3 (noarch):.noarch.rpm