Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.2.28 and prior to 6.0.6. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core).
    Supported versions that are affected are Prior to 5.2.28 and prior to 6.0.6. Easily exploitable     vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox     executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks     may significantly impact additional products. Successful attacks of this vulnerability can result in     unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data.
    (CVE-2019-2678)

Note that Nessus relies on the presence of the package as reported by the vendor.

This update for virtualbox to version 6.0.10 fixes the following issues :

Security issues fixed :

  - CVE-2019-2859 CVE-2019-2867 CVE-2019-2866 CVE-2019-2864     CVE-2019-2865 CVE-2019-1543 CVE-2019-2863 CVE-2019-2848     CVE-2019-2877 CVE-2019-2873 CVE-2019-2874 CVE-2019-2875     CVE-2019-2876 CVE-2019-2850 (boo#1141801)

The version of Oracle VM VirtualBox running on the remote host is 5.2.x prior to 5.2.28 or 6.0.x prior to 6.0.6. It is, therefore, affected by multiple vulnerabilities as noted in the April 2019 Critical Patch Update advisory :

  - Multiple unspecified vulnerabilities in the Core     component of Oracle VirtualBox could allow an     authenticated, local attacker with logon to the     infrastructure where Oracle VM VirtualBox executes to     compromise Oracle VM VirtualBox.     (CVE-2019-2656, CVE-2019-2657,CVE-2019-2680,CVE-2019-2690,      CVE-2019-2696,CVE-2019-2703,CVE-2019-2721,CVE-2019-2722,      CVE-2019-2723)

  - Multiple unspecified vulnerabilities in the Core     component of Oracle VirtualBox could allow an     authenticated, local attacker with logon to the     infrastructure where Oracle VM VirtualBox executes to     potentially expose critical or confidential data.
    (CVE-2019-2574, CVE-2019-2678, CVE-2019-2679)

ID	Name	Product	Family	Severity
255050	Linux Distros Unpatched Vulnerability : CVE-2019-2678	Nessus	Misc.	medium
127734	openSUSE Security Update : virtualbox (openSUSE-2019-1814)	Nessus	SuSE Local Security Checks	critical
124167	Oracle VM VirtualBox 5.2.x < 5.2.28 / 6.0.x < 6.0.6 (Apr 2019 CPU)	Nessus	Misc.	high

Detections

Analytics

CVE-2019-2678

medium

Tenable Plugins

medium

critical

high