Debian DSA-3274-1 : virtualbox - security update (Venom)
high Nessus Plugin ID 83889
Language:
New! Plugin Severity Now Using CVSS v3
The calculated severity for Plugins has been updated to use CVSS v3 by default. Plugins that do not have a CVSS v3 score will fall back to CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.
Synopsis
The remote Debian host is missing a security-related update.Description
Jason Geffner discovered a buffer overflow in the emulated floppy disk drive, resulting in potential privilege escalation.Solution
Upgrade the virtualbox packages.For the oldstable distribution (wheezy), this problem has been fixed in version 4.1.18-dfsg-2+deb7u5.
For the stable distribution (jessie), this problem has been fixed in version 4.3.18-dfsg-3+deb8u2.
See Also
https://packages.debian.org/source/wheezy/virtualbox
Plugin Details
Severity: High
ID: 83889
File Name: debian_DSA-3274.nasl
Version: 2.10
Type: local
Agent: unix
Family: Debian Local Security Checks
Published: 5/29/2015
Updated: 1/11/2021
Dependencies: ssh_get_info.nasl
Risk Information
VPR
Risk Factor: Critical
Score: 9.5
CVSS v2
Risk Factor: High
Base Score: 7.7
Temporal Score: 6.4
Vector: AV:A/AC:L/Au:S/C:C/I:C/A:C
Temporal Vector: E:F/RL:OF/RC:C
Vulnerability Information
CPE: p-cpe:/a:debian:debian_linux:virtualbox, cpe:/o:debian:debian_linux:7.0, cpe:/o:debian:debian_linux:8.0
Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 5/28/2015
Exploitable With
Core Impact
Reference Information
CVE: CVE-2015-3456
BID: 74640
DSA: 3274