Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.2.28 and prior to 6.0.6. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).

This update for virtualbox to version 6.0.10 fixes the following issues :

Security issues fixed :

  - CVE-2019-2859 CVE-2019-2867 CVE-2019-2866 CVE-2019-2864     CVE-2019-2865 CVE-2019-1543 CVE-2019-2863 CVE-2019-2848     CVE-2019-2877 CVE-2019-2873 CVE-2019-2874 CVE-2019-2875     CVE-2019-2876 CVE-2019-2850 (boo#1141801)

The version of Oracle VM VirtualBox running on the remote host is 5.2.x prior to 5.2.28 or 6.0.x prior to 6.0.6. It is, therefore, affected by multiple vulnerabilities as noted in the April 2019 Critical Patch Update advisory :

  - Multiple unspecified vulnerabilities in the Core     component of Oracle VirtualBox could allow an     authenticated, local attacker with logon to the     infrastructure where Oracle VM VirtualBox executes to     compromise Oracle VM VirtualBox.     (CVE-2019-2656, CVE-2019-2657,CVE-2019-2680,CVE-2019-2690,      CVE-2019-2696,CVE-2019-2703,CVE-2019-2721,CVE-2019-2722,      CVE-2019-2723)

  - Multiple unspecified vulnerabilities in the Core     component of Oracle VirtualBox could allow an     authenticated, local attacker with logon to the     infrastructure where Oracle VM VirtualBox executes to     potentially expose critical or confidential data.
    (CVE-2019-2574, CVE-2019-2678, CVE-2019-2679)

ID	Name	Product	Family	Severity
127734	openSUSE Security Update : virtualbox (openSUSE-2019-1814)	Nessus	SuSE Local Security Checks	critical
124167	Oracle VM VirtualBox 5.2.x < 5.2.28 / 6.0.x < 6.0.6 (Apr 2019 CPU)	Nessus	Misc.	high

Detections

Analytics

CVE-2019-2678

medium

Tenable Plugins

critical

high