The version of the Oracle VM VirtualBox application installed on the remote host is 5.0.x prior to 5.0.28 or 5.1.x prior to 5.1.8. It is, therefore, affected by multiple vulnerabilities :

  - Multiple unspecified flaws exist in the Core     subcomponent that allow a local attacker to gain     elevated privileges. (CVE-2016-5501, CVE-2016-5538)

  - An unspecified flaw exists in the VirtualBox Remote     Desktop Extension (VRDE) subcomponent that allows an     unauthenticated, remote attacker to impact     confidentiality and integrity. (CVE-2016-5605)

  - Multiple unspecified flaws exist in the Core     subcomponent that allow a local attacker to cause a     denial of service condition. (CVE-2016-5608,     CVE-2016-5613)

  - An unspecified flaw exists in the Core subcomponent that     allows a local attacker to impact on integrity and     availability. (CVE-2016-5610)

  - An unspecified flaw exists in the Core subcomponent that     allows a local attacker to disclose sensitive     information. (CVE-2016-5611)

  - A flaw exists in the OpenSSL subcomponent, specifically     within the ssl_parse_clienthello_tlsext() function in     t1_lib.c due, to improper handling of overly large OCSP     Status Request extensions from clients. An     unauthenticated, remote attacker can exploit this, via     large OCSP Status Request extensions, to exhaust memory     resources, resulting in a denial of service condition.
    (CVE-2016-6304)

Detections

Analytics

Oracle VM VirtualBox 5.0.x < 5.0.28 / 5.1.x < 5.1.8 Multiple Vulnerabilities (October 2016 CPU)

critical Nessus Plugin ID 94168

Version 1.13

Version 1.12

Version 1.13 May 5, 2026, 10:13 PM Logic Changes (converted to VDF) Plugin Feed: 202605052213
Version 1.12 Jan 21, 2026, 10:50 AM CVSSv3 score source (set to "CVE-2016-5605") CVSSv3 severity (based on CVE-2016-5605, severity increased from "Medium" to "High") CVSS metrics ("CVSSv3 score" set to 9.1) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N") Plugin Feed: 202601211050