Oracle VirtualBox crServerDispatchGetVertexAttribdvNV Out-Of-Bounds Read Information Disclosure Vulnerability

🗓️ 17 Apr 2019 00:00:00Reported by Jason Matthyser of MWR LabsType

zdi🔗 www.zerodayinitiative.com👁 14 Views

Oracle VirtualBox crServerDispatchGetVertexAttribdvNV Out-Of-Bounds Read Information Disclosure Vulnerability allows local attackers to disclose sensitive information on vulnerable installations of Oracle VirtualBox. An attacker must execute low-privileged code on the target guest system to exploit this vulnerability. The flaw lies within the crServerDispatchGetVertexAttribdvNV method, due to lack of user data validation, which results in a read past the allocated object. This can be coupled with other vulnerabilities to execute code in the hypervisor context

Reporter	Title	Published	Views	Family All 47
CVE	CVE-2019-2574	23 Apr 201918:16	–	cve
Cvelist	CVE-2019-2574	23 Apr 201918:16	–	cvelist
Debian CVE	CVE-2019-2574	23 Apr 201918:16	–	debiancve
EUVD	EUVD-2019-12214	7 Oct 202500:30	–	euvd
Kaspersky	KLA11471 Multiple vulnerabilities in Oracle VirtualBox	16 Apr 201900:00	–	kaspersky
Mageia	Virtualbox 6.0.6 fixes security vulnerabilities	4 May 201920:13	–	mageia
NVD	CVE-2019-2574	23 Apr 201919:32	–	nvd
Tenable Nessus	openSUSE Security Update : virtualbox (openSUSE-2019-1814)	12 Aug 201900:00	–	nessus
Tenable Nessus	Linux Distros Unpatched Vulnerability : CVE-2019-2574	30 Aug 202500:00	–	nessus
Tenable Nessus	Oracle VM VirtualBox 5.2.x < 5.2.28 / 6.0.x < 6.0.6 (Apr 2019 CPU)	18 Apr 201900:00	–	nessus