PT-2015-2482 · Oracle+1 · Virtualbox+1

Published 2015-10-21 · Updated 2024-06-15 · CVE-2015-4896

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Oracle VM VirtualBox versions prior to 4.0.34 Oracle VM VirtualBox versions prior to 4.1.42 Oracle VM VirtualBox versions prior to 4.2.34 Oracle VM VirtualBox versions prior to 4.3.32 Oracle VM VirtualBox versions prior to 5.0.8

Description The issue is related to errors in the code of Oracle VM VirtualBox, which can be exploited by a remote attacker to cause a denial of service when the Remote Display feature (RDP) is enabled. The exact vectors related to the Core component are unknown.

Recommendations For versions prior to 4.0.34, update to version 4.0.34 or later. For versions prior to 4.1.42, update to version 4.1.42 or later. For versions prior to 4.2.34, update to version 4.2.34 or later. For versions prior to 4.3.32, update to version 4.3.32 or later. For versions prior to 5.0.8, update to version 5.0.8 or later. As a temporary workaround, consider disabling the Remote Display feature (RDP) until a patch is available.

Fix

Weakness Enumeration

CWE-17

Related Identifiers

ALT-PU-2016-1230

ALT-PU-2016-1231

ALT-PU-2016-1232

ALT-PU-2016-1256

ALT-PU-2016-1263

BDU:2015-11847

CVE-2015-4896

DSA-3384-1

MGASA-2015-0415

OPENSUSE-SU-2024:10020-1

Affected Products

Alt Linux

Virtualbox

References · 62

• https://security-tracker.debian.org/tracker/source-package/virtualbox · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8104 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0495 · Security Note
• https://errata.altlinux.org/ALT-PU-2016-1230 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-4896 · Vendor Advisory
• https://bdu.fstec.ru/vul/2016-01655 · Security Note
• https://cve.org/CVERecord?id=CVE-2015-4896 · Security Note
• http://lists.opensuse.org/opensuse-updates/2015-11/msg00000.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10020-1 · Vendor Advisory
• http://oracle.com/technetwork/topics/security/cpuoct2015-2367953.html · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3384-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0592 · Security Note
• https://osv.dev/vulnerability/MGASA-2015-0415 · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2015-11/msg00172.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-11913 · Security Note