PT-2023-1185 · Oracle+2 · Virtualbox+2

Aobo Wang

+1

·

Published

2023-01-17

·

Updated

2024-06-15

·

CVE-2023-21885

CVSS v3.1

3.8

Low

VectorAV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Name of the Vulnerable Software and Affected Versions Oracle VM VirtualBox versions prior to 6.1.42 and prior to 7.0.6
Description The issue is related to insufficient input validation in the Core component of Oracle VM VirtualBox, allowing a low-privileged attacker with logon access to the infrastructure to compromise Oracle VM VirtualBox. Successful attacks can result in unauthorized read access to a subset of Oracle VM VirtualBox accessible data. This issue may significantly impact additional products and applies to Windows only.
Recommendations For versions prior to 6.1.42 and prior to 7.0.6, update to a version that addresses this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-20

Related Identifiers

ALT-PU-2023-1071
ALT-PU-2023-1072
ALT-PU-2023-1073
ALT-PU-2023-1074
ALT-PU-2023-1075
ALT-PU-2023-1639
ALT-PU-2023-1640
ALT-PU-2023-1641
ALT-PU-2023-1642
ALT-PU-2023-1643
ALT-PU-2023-4088
ALT-PU-2023-4089
ALT-PU-2023-4090
ALT-PU-2023-4664
ALT-PU-2023-4665
ALT-PU-2023-4729
ALT-PU-2023-4730
BDU:2023-00408
CVE-2023-21885
OPENSUSE-SU-2023:0033-1
OPENSUSE-SU-2023_0033-1
OPENSUSE-SU-2024:12640-1

Affected Products

Alt Linux
Virtualbox
Suse