CVSS: 4.4EPSS: 0%CPEs: 15EXPL: 4CVE-2014-0981 – Oracle VM VirtualBox - 3D Acceleration Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2014-0981
VBox/GuestHost/OpenGL/util/net.c in Oracle VirtualBox before 3.2.22, 4.0.x before 4.0.24, 4.1.x before 4.1.32, 4.2.x before 4.2.24, and 4.3.x before 4.3.8, when using 3D Acceleration allows local guest OS users to execute arbitrary code on the Chromium server via crafted Chromium network pointer in a (1) CR_MESSAGE_READBACK or (2) CR_MESSAGE_WRITEBACK message to the VBoxSharedCrOpenGL service, which triggers an arbitrary pointer dereference and memory corruption. NOTE: this issue was MERGED with CVE-2014-0982 because it is the same type of vulnerability affecting the same set of versions. All CVE users should reference CVE-2014-0981 instead of CVE-2014-0982. Se presenta una vulnerabilidad en el archivo VBox/GuestHost/OpenGL/util/net.c en Oracle VirtualBox versiones anteriores a 3.2.22, versiones 4.0.x anteriores a 4.0.24, versiones 4.1.x anteriores a 4.1.32, versiones 4.2.x anteriores a 4.2.24 y versiones 4.3.x anteriores a 4.3. 8, cuando se usa la aceleración 3D, los usuarios del OS invitado local pueden ejecutar un código arbitrario en el servidor Chromium por medio de un puntero de red Chromium diseñado en un mensaje (1) CR_MESSAGE_READBACK o (2) CR_MESSAGE_WRITEBACK hacia el servicio VBoxSharedCrOpenGL, lo que desencadena una desreferencia de puntero arbitraria y la corrupción de la memoria . NOTA: este problema fue FUSIONADO con el CVE-2014-0982 porque es el mismo tipo de vulnerabilidad afectando al mismo conjunto de versiones. • https://www.exploit-db.com/exploits/32208 http://seclists.org/fulldisclosure/2014/Mar/95 http://secunia.com/advisories/57384 http://www.coresecurity.com/advisories/oracle-virtualbox-3d-acceleration-multiple-memory-corruption-vulnerabilities http://www.debian.org/security/2014/dsa-2904 http://www.exploit-db.com/exploits/32208 http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html http://www.securityfocus.com/archive/1/531418/100/0/threaded https://security.gentoo.org/glsa/ • CWE-399: Resource Management Errors •
CVSS: 6.9EPSS: 0%CPEs: 15EXPL: 5CVE-2014-0983 – Oracle VM VirtualBox - 3D Acceleration Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2014-0983
Multiple array index errors in programs that are automatically generated by VBox/HostServices/SharedOpenGL/crserverlib/server_dispatch.py in Oracle VirtualBox 4.2.x through 4.2.20 and 4.3.x before 4.3.8, when using 3D Acceleration, allow local guest OS users to execute arbitrary code on the Chromium server via certain CR_MESSAGE_OPCODES messages with a crafted index, which are not properly handled by the (1) CR_VERTEXATTRIB4NUBARB_OPCODE to the crServerDispatchVertexAttrib4NubARB function, (2) CR_VERTEXATTRIB1DARB_OPCODE to the crServerDispatchVertexAttrib1dARB function, (3) CR_VERTEXATTRIB1FARB_OPCODE to the crServerDispatchVertexAttrib1fARB function, (4) CR_VERTEXATTRIB1SARB_OPCODE to the crServerDispatchVertexAttrib1sARB function, (5) CR_VERTEXATTRIB2DARB_OPCODE to the crServerDispatchVertexAttrib2dARB function, (6) CR_VERTEXATTRIB2FARB_OPCODE to the crServerDispatchVertexAttrib2fARB function, (7) CR_VERTEXATTRIB2SARB_OPCODE to the crServerDispatchVertexAttrib2sARB function, (8) CR_VERTEXATTRIB3DARB_OPCODE to the crServerDispatchVertexAttrib3dARB function, (9) CR_VERTEXATTRIB3FARB_OPCODE to the crServerDispatchVertexAttrib3fARB function, (10) CR_VERTEXATTRIB3SARB_OPCODE to the crServerDispatchVertexAttrib3sARB function, (11) CR_VERTEXATTRIB4DARB_OPCODE to the crServerDispatchVertexAttrib4dARB function, (12) CR_VERTEXATTRIB4FARB_OPCODE to the crServerDispatchVertexAttrib4fARB function, and (13) CR_VERTEXATTRIB4SARB_OPCODE to the crServerDispatchVertexAttrib4sARB function. Múltiples errores de índice de matriz en programas que son generados automáticamente por la biblioteca VBox/HostServices/ SharedOpenGL/crserverlib/server_dispatch.py ??en Oracle VirtualBox versiones 4.2.x hasta 4.2.20 y versiones 4.3.x anteriores a 4.3.8, cuando se usa la aceleración 3D, permite a usuarios del SO invitado local ejecutar código arbitrario en el servidor Chromium por medio de ciertos mensajes CR_MESSAGE_OPCODES con un índice diseñado, que no está apropiadamente manejado por el (1) CR_VERTEXATTRIB4NUBARB_OPCODE en la función crServerDispatchVertexAttrib4NubARB, (2) CR_VERTEXATTRIB1DARB_OPCODEen la función crServerDispatchVertexAttrib1dARB, (3) CR_VERTEXATTRIB1FARB_OPCODE en la crServerDispatchVertexAttrib1fARB función, (4) CR_VERTEXATTRIB1SARB_OPCODE en la función crServerDispatchVertexAttrib1sARB, (5) CR_VERTEXATTRIB2DARB_OPCODE en la función crServerDispatchVertexAttrib2dARB, (6) CR_VERTEXATTRIB2FARB_OPCODE en la función crServerDispatchVertexAttrib2fARB, (7) CR_VERTEXATTRIB2SARB_OPCODE en la función crServerDispatchVertexAttrib2sARB, (8) CR_ VERTEXATTRIB3DARB_OPCODE en la función crServerDispatchVertexAttrib3dARB, (9) CR_VERTEXATTRIB3FARB_OPCODE en la función crServerDispatchVertexAttrib3fARB, (10) CR_VERTEXATTRIB3SARB_OPCODE en la función crServerDispatchVertexAttrib3sARB, (11) CR_VERTEXATTRIB4DARB_OPCODE en la función crServerDispatchVertexAttrib4dARB, (12) CR_VERTEXATTRIB4FARB_OPCODE en la función crServerDispatchVertexAttrib4fARB, y (13) CR_VERTEXATTRIB4SARB_OPCODE en la función crServerDispatchVertexAttrib4sARB. • https://www.exploit-db.com/exploits/32208 https://www.exploit-db.com/exploits/34334 http://seclists.org/fulldisclosure/2014/Mar/95 http://secunia.com/advisories/57384 http://www.coresecurity.com/advisories/oracle-virtualbox-3d-acceleration-multiple-memory-corruption-vulnerabilities http://www.debian.org/security/2014/dsa-2904 http://www.exploit-db.com/exploits/32208 http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html http://www.securityfocus.com/archive/1/531418/100/0&# • CWE-399: Resource Management Errors •
CVSS: 2.4EPSS: 0%CPEs: 49EXPL: 0CVE-2014-0404
https://notcve.org/view.php?id=CVE-2014-0404
Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 3.2.20, 4.0.22, 4.1.30, 4.2.20, and 4.3.4 allows local users to affect integrity and availability via unknown vectors related to Core, a different vulnerability than CVE-2014-0406. Vulnerabilidad no especificada en el componente de Oracle VM VirtualBox en Oracle Virtualization VirtualBox antes del 3.2.20, 4.0.22, 4.1.30, 4.2.20 y 4.3.4 permite a usuarios locales afectar la confidencialidad, integridad y disponibilidad a través de vectores desconocidos relacionados con Core. Una vulnerabilidad distinta a CVE-2014-0406. • http://osvdb.org/102061 http://secunia.com/advisories/56490 http://www.debian.org/security/2014/dsa-2878 http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html http://www.securityfocus.com/bid/64758 http://www.securityfocus.com/bid/64911 http://www.securitytracker.com/id/1029610 https://exchange.xforce.ibmcloud.com/vulnerabilities/90372 •
CVSS: 2.4EPSS: 0%CPEs: 49EXPL: 0CVE-2014-0406
https://notcve.org/view.php?id=CVE-2014-0406
Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 3.2.20, 4.0.22, 4.1.30, 4.2.20, and 4.3.4 allows local users to affect integrity and availability via unknown vectors related to Core, a different vulnerability than CVE-2014-0404. Vulnerabilidad no especificada en el componente de Oracle VM VirtualBox en Oracle Virtualization VirtualBox antes del 3.2.20, 4.0.22, 4.1.30, 4.2.20 y 4.3.4 permite a usuarios locales afectar la confidencialidad, integridad y disponibilidad a través de vectores desconocidos relacionados con Core. Una vulnerabilidad distinta a CVE-2014-0404. • http://osvdb.org/102060 http://secunia.com/advisories/56490 http://www.debian.org/security/2014/dsa-2878 http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html http://www.securityfocus.com/bid/64758 http://www.securityfocus.com/bid/64905 http://www.securitytracker.com/id/1029610 https://exchange.xforce.ibmcloud.com/vulnerabilities/90371 •
CVSS: 3.5EPSS: 0%CPEs: 49EXPL: 0CVE-2014-0405
https://notcve.org/view.php?id=CVE-2014-0405
Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 3.2.20, 4.0.22, 4.1.30, 4.2.20, and 4.3.4 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Core, a different vulnerability than CVE-2014-0407. Vulnerabilidad no especificada en el componente Oracle VM VirtualBox en Oracle Virtualization VirtualBox en versiones anteriores a 3.2.20, 4.0.22, 4.1.30, 4.2.20 y 4.3.4 permite a usuarios locales afectar la confidencialidad, la integridad y la disponibilidad a través de vectores desconocidos relacionados con Core, una vulnerabilidad diferente a CVE-2014-0407. • http://osvdb.org/102059 http://secunia.com/advisories/56490 http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html http://www.securityfocus.com/bid/64758 http://www.securityfocus.com/bid/64900 http://www.securitytracker.com/id/1029610 https://exchange.xforce.ibmcloud.com/vulnerabilities/90370 •