Headline

Gentoo Linux Security Advisory 202212-03

Gentoo Linux Security Advisory 202212-3 - Multiple vulnerabilities have been discovered in Oracle Virtualbox, the worst of which could result in privilege escalation from a guest to the host. Versions less than 6.1.40 are affected.

1 year ago

Packet Storm

Open in Source

#vulnerability #web #mac #linux #oracle

Gentoo Linux Security Advisory GLSA 202212-03

                                       https://security.gentoo.org/

Severity: High
Title: Oracle VirtualBox: Multiple Vulnerabilities
Date: December 19, 2022
Bugs: #877601
ID: 202212-03

Synopsis

Multiple vulnerabilities have been discovered in Oracle Virtualbox, the
worst of which could result in privilege escalation from a guest to the
host.

Background

VirtualBox is a powerful virtualization product from Oracle.

Affected packages

-------------------------------------------------------------------  
 Package              /     Vulnerable     /            Unaffected  
-------------------------------------------------------------------

1 app-emulation/virtualbox < 6.1.40 >= 6.1.40
2 app-emulation/virtualbox-modules < 6.1.40 >= 6.1.40

Description

Multiple vulnerabilities have been discovered in Oracle VirtualBox.
Please review the CVE identifiers referenced below for details.

Impact

Please review the referenced CVE identifiers for details.

Workaround

There is no known workaround at this time.

Resolution

All Oracle VirtualBox users should upgrade to the latest version:

emerge --sync

emerge --ask --oneshot --verbose “>=app-emulation/virtualbox-6.1.40”

All Oracle VirtualBox modules users should upgrade to the latest
version:

emerge --sync

emerge --ask --oneshot --verbose “>=app-emulation/virtualbox-modules-6.1.40”

References

[ 1 ] CVE-2022-21620
https://nvd.nist.gov/vuln/detail/CVE-2022-21620
[ 2 ] CVE-2022-21621
https://nvd.nist.gov/vuln/detail/CVE-2022-21621
[ 3 ] CVE-2022-21627
https://nvd.nist.gov/vuln/detail/CVE-2022-21627
[ 4 ] CVE-2022-39421
https://nvd.nist.gov/vuln/detail/CVE-2022-39421
[ 5 ] CVE-2022-39422
https://nvd.nist.gov/vuln/detail/CVE-2022-39422
[ 6 ] CVE-2022-39423
https://nvd.nist.gov/vuln/detail/CVE-2022-39423
[ 7 ] CVE-2022-39424
https://nvd.nist.gov/vuln/detail/CVE-2022-39424
[ 8 ] CVE-2022-39425
https://nvd.nist.gov/vuln/detail/CVE-2022-39425
[ 9 ] CVE-2022-39426
https://nvd.nist.gov/vuln/detail/CVE-2022-39426

Availability

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

https://security.gentoo.org/glsa/202212-03

Concerns?

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users’ machines is of utmost
importance to us. Any security concerns should be addressed to
[email protected] or alternatively, you may file a bug at
https://bugs.gentoo.org.

License

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

https://creativecommons.org/licenses/by-sa/2.5

Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload). Supported versions that are affected are 12.2.3-12.2.11. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator. Successful attacks of this vulnerability can result in takeover of Oracle Web Applications Desktop Integrator. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).