CVSS: 6.9EPSS: 0%CPEs: 15EXPL: 5CVE-2014-0983 – Oracle VM VirtualBox - 3D Acceleration Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2014-0983
Multiple array index errors in programs that are automatically generated by VBox/HostServices/SharedOpenGL/crserverlib/server_dispatch.py in Oracle VirtualBox 4.2.x through 4.2.20 and 4.3.x before 4.3.8, when using 3D Acceleration, allow local guest OS users to execute arbitrary code on the Chromium server via certain CR_MESSAGE_OPCODES messages with a crafted index, which are not properly handled by the (1) CR_VERTEXATTRIB4NUBARB_OPCODE to the crServerDispatchVertexAttrib4NubARB function, (2) CR_VERTEXATTRIB1DARB_OPCODE to the crServerDispatchVertexAttrib1dARB function, (3) CR_VERTEXATTRIB1FARB_OPCODE to the crServerDispatchVertexAttrib1fARB function, (4) CR_VERTEXATTRIB1SARB_OPCODE to the crServerDispatchVertexAttrib1sARB function, (5) CR_VERTEXATTRIB2DARB_OPCODE to the crServerDispatchVertexAttrib2dARB function, (6) CR_VERTEXATTRIB2FARB_OPCODE to the crServerDispatchVertexAttrib2fARB function, (7) CR_VERTEXATTRIB2SARB_OPCODE to the crServerDispatchVertexAttrib2sARB function, (8) CR_VERTEXATTRIB3DARB_OPCODE to the crServerDispatchVertexAttrib3dARB function, (9) CR_VERTEXATTRIB3FARB_OPCODE to the crServerDispatchVertexAttrib3fARB function, (10) CR_VERTEXATTRIB3SARB_OPCODE to the crServerDispatchVertexAttrib3sARB function, (11) CR_VERTEXATTRIB4DARB_OPCODE to the crServerDispatchVertexAttrib4dARB function, (12) CR_VERTEXATTRIB4FARB_OPCODE to the crServerDispatchVertexAttrib4fARB function, and (13) CR_VERTEXATTRIB4SARB_OPCODE to the crServerDispatchVertexAttrib4sARB function. Múltiples errores de índice de matriz en programas que son generados automáticamente por la biblioteca VBox/HostServices/ SharedOpenGL/crserverlib/server_dispatch.py ??en Oracle VirtualBox versiones 4.2.x hasta 4.2.20 y versiones 4.3.x anteriores a 4.3.8, cuando se usa la aceleración 3D, permite a usuarios del SO invitado local ejecutar código arbitrario en el servidor Chromium por medio de ciertos mensajes CR_MESSAGE_OPCODES con un índice diseñado, que no está apropiadamente manejado por el (1) CR_VERTEXATTRIB4NUBARB_OPCODE en la función crServerDispatchVertexAttrib4NubARB, (2) CR_VERTEXATTRIB1DARB_OPCODEen la función crServerDispatchVertexAttrib1dARB, (3) CR_VERTEXATTRIB1FARB_OPCODE en la crServerDispatchVertexAttrib1fARB función, (4) CR_VERTEXATTRIB1SARB_OPCODE en la función crServerDispatchVertexAttrib1sARB, (5) CR_VERTEXATTRIB2DARB_OPCODE en la función crServerDispatchVertexAttrib2dARB, (6) CR_VERTEXATTRIB2FARB_OPCODE en la función crServerDispatchVertexAttrib2fARB, (7) CR_VERTEXATTRIB2SARB_OPCODE en la función crServerDispatchVertexAttrib2sARB, (8) CR_ VERTEXATTRIB3DARB_OPCODE en la función crServerDispatchVertexAttrib3dARB, (9) CR_VERTEXATTRIB3FARB_OPCODE en la función crServerDispatchVertexAttrib3fARB, (10) CR_VERTEXATTRIB3SARB_OPCODE en la función crServerDispatchVertexAttrib3sARB, (11) CR_VERTEXATTRIB4DARB_OPCODE en la función crServerDispatchVertexAttrib4dARB, (12) CR_VERTEXATTRIB4FARB_OPCODE en la función crServerDispatchVertexAttrib4fARB, y (13) CR_VERTEXATTRIB4SARB_OPCODE en la función crServerDispatchVertexAttrib4sARB. • https://www.exploit-db.com/exploits/32208 https://www.exploit-db.com/exploits/34334 http://seclists.org/fulldisclosure/2014/Mar/95 http://secunia.com/advisories/57384 http://www.coresecurity.com/advisories/oracle-virtualbox-3d-acceleration-multiple-memory-corruption-vulnerabilities http://www.debian.org/security/2014/dsa-2904 http://www.exploit-db.com/exploits/32208 http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html http://www.securityfocus.com/archive/1/531418/100/0&# • CWE-399: Resource Management Errors •
CVSS: 2.4EPSS: 0%CPEs: 49EXPL: 0CVE-2014-0404
https://notcve.org/view.php?id=CVE-2014-0404
Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 3.2.20, 4.0.22, 4.1.30, 4.2.20, and 4.3.4 allows local users to affect integrity and availability via unknown vectors related to Core, a different vulnerability than CVE-2014-0406. Vulnerabilidad no especificada en el componente de Oracle VM VirtualBox en Oracle Virtualization VirtualBox antes del 3.2.20, 4.0.22, 4.1.30, 4.2.20 y 4.3.4 permite a usuarios locales afectar la confidencialidad, integridad y disponibilidad a través de vectores desconocidos relacionados con Core. Una vulnerabilidad distinta a CVE-2014-0406. • http://osvdb.org/102061 http://secunia.com/advisories/56490 http://www.debian.org/security/2014/dsa-2878 http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html http://www.securityfocus.com/bid/64758 http://www.securityfocus.com/bid/64911 http://www.securitytracker.com/id/1029610 https://exchange.xforce.ibmcloud.com/vulnerabilities/90372 •
CVSS: 2.4EPSS: 0%CPEs: 49EXPL: 0CVE-2014-0406
https://notcve.org/view.php?id=CVE-2014-0406
Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 3.2.20, 4.0.22, 4.1.30, 4.2.20, and 4.3.4 allows local users to affect integrity and availability via unknown vectors related to Core, a different vulnerability than CVE-2014-0404. Vulnerabilidad no especificada en el componente de Oracle VM VirtualBox en Oracle Virtualization VirtualBox antes del 3.2.20, 4.0.22, 4.1.30, 4.2.20 y 4.3.4 permite a usuarios locales afectar la confidencialidad, integridad y disponibilidad a través de vectores desconocidos relacionados con Core. Una vulnerabilidad distinta a CVE-2014-0404. • http://osvdb.org/102060 http://secunia.com/advisories/56490 http://www.debian.org/security/2014/dsa-2878 http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html http://www.securityfocus.com/bid/64758 http://www.securityfocus.com/bid/64905 http://www.securitytracker.com/id/1029610 https://exchange.xforce.ibmcloud.com/vulnerabilities/90371 •
CVSS: 3.5EPSS: 0%CPEs: 49EXPL: 0CVE-2014-0405
https://notcve.org/view.php?id=CVE-2014-0405
Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 3.2.20, 4.0.22, 4.1.30, 4.2.20, and 4.3.4 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Core, a different vulnerability than CVE-2014-0407. Vulnerabilidad no especificada en el componente Oracle VM VirtualBox en Oracle Virtualization VirtualBox en versiones anteriores a 3.2.20, 4.0.22, 4.1.30, 4.2.20 y 4.3.4 permite a usuarios locales afectar la confidencialidad, la integridad y la disponibilidad a través de vectores desconocidos relacionados con Core, una vulnerabilidad diferente a CVE-2014-0407. • http://osvdb.org/102059 http://secunia.com/advisories/56490 http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html http://www.securityfocus.com/bid/64758 http://www.securityfocus.com/bid/64900 http://www.securitytracker.com/id/1029610 https://exchange.xforce.ibmcloud.com/vulnerabilities/90370 •
CVSS: 3.5EPSS: 0%CPEs: 49EXPL: 0CVE-2014-0407
https://notcve.org/view.php?id=CVE-2014-0407
Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 3.2.20, 4.0.22, 4.1.30, 4.2.20, and 4.3.4 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Core, a different vulnerability than CVE-2014-0405. Vulnerabilidad no especificada en el componente Oracle VM VirtualBox en Oracle Virtualization VirtualBox en versiones anteriores a 3.2.20, 4.0.22, 4.1.30, 4.2.20 y 4.3.4 permite a usuarios locales afectar la confidencialidad, la integridad y la disponibilidad a través de vectores desconocidos relacionados con Core, una vulnerabilidad diferente a CVE-2014-0405. • http://osvdb.org/102058 http://secunia.com/advisories/56490 http://www.debian.org/security/2014/dsa-2878 http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html http://www.securityfocus.com/bid/64758 http://www.securityfocus.com/bid/64913 http://www.securitytracker.com/id/1029610 https://exchange.xforce.ibmcloud.com/vulnerabilities/90369 •