Security update for virtualbox SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2018:1057-1 Final 1 1 2018-04-23T21:38:06Z current 2018-04-23T21:38:06Z 2018-04-23T21:38:06Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for virtualbox This update for VirtualBox to version 5.1.36 fixes multiple issues: Security issues fixed: - CVE-2018-0739: Unauthorized remote attacker may have caused a hang or frequently repeatable crash (complete DOS) - CVE-2018-2830: Attacker with host login may have compromised Virtualbox or further system services after interaction with a third user - CVE-2018-2831: Attacker with host login may have compromised VirtualBox or further system services, allowing read access to some data - CVE-2018-2835: Attacker with host login may have gained control over VirtualBox and possibly further system services after interacting with a third user - CVE-2018-2836: Attacker with host login may have gained control over VirtualBox and possibly further system services after interacting with a third user - CVE-2018-2837: Attacker with host login may have gained control over VirtualBox and possibly further system services after interacting with a third user - CVE-2018-2842: Attacker with host login may have gained control over VirtualBox and possibly further system services after interacting with a third user - CVE-2018-2843: Attacker with host login may have gained control over VirtualBox and possibly further system services after interacting with a third user - CVE-2018-2844: Attacker with host login may have gained control over VirtualBox and possibly further system services after interacting with a third user - CVE-2018-2845: Attacker with host login may have caused a hang or frequently repeatable crash (complete DOS), and perform unauthorized read and write operation to some VirtualBox accessible data - CVE-2018-2860: Privileged attacker may have gained control over VirtualBox and possibly further system services http://www.oracle.com/technetwork/security-advisory/cpuapr2018verbose-3678108.html http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html#AppendixOVIR This update also contains all upstream fixes and improvements in the stable 5.1.36 release. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/opensuse-security-announce/2018-04/msg00069.html E-Mail link for openSUSE-SU-2018:1057-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings openSUSE Leap 42.3 python-virtualbox-5.1.36-50.1 virtualbox-5.1.36-50.1 virtualbox-devel-5.1.36-50.1 virtualbox-guest-desktop-icons-5.1.36-50.1 virtualbox-guest-kmp-default-5.1.36_k4.4.126_48-50.1 virtualbox-guest-source-5.1.36-50.1 virtualbox-guest-tools-5.1.36-50.1 virtualbox-guest-x11-5.1.36-50.1 virtualbox-host-kmp-default-5.1.36_k4.4.126_48-50.1 virtualbox-host-source-5.1.36-50.1 virtualbox-qt-5.1.36-50.1 virtualbox-vnc-5.1.36-50.1 virtualbox-websrv-5.1.36-50.1 python-virtualbox-5.1.36-50.1 as a component of openSUSE Leap 42.3 virtualbox-5.1.36-50.1 as a component of openSUSE Leap 42.3 virtualbox-devel-5.1.36-50.1 as a component of openSUSE Leap 42.3 virtualbox-guest-desktop-icons-5.1.36-50.1 as a component of openSUSE Leap 42.3 virtualbox-guest-kmp-default-5.1.36_k4.4.126_48-50.1 as a component of openSUSE Leap 42.3 virtualbox-guest-source-5.1.36-50.1 as a component of openSUSE Leap 42.3 virtualbox-guest-tools-5.1.36-50.1 as a component of openSUSE Leap 42.3 virtualbox-guest-x11-5.1.36-50.1 as a component of openSUSE Leap 42.3 virtualbox-host-kmp-default-5.1.36_k4.4.126_48-50.1 as a component of openSUSE Leap 42.3 virtualbox-host-source-5.1.36-50.1 as a component of openSUSE Leap 42.3 virtualbox-qt-5.1.36-50.1 as a component of openSUSE Leap 42.3 virtualbox-vnc-5.1.36-50.1 as a component of openSUSE Leap 42.3 virtualbox-websrv-5.1.36-50.1 as a component of openSUSE Leap 42.3 OpenSSL 1.0.2 (starting from version 1.0.2b) introduced an "error state" mechanism. The intent was that if a fatal error occurred during a handshake then OpenSSL would move into the error state and would immediately fail if you attempted to continue the handshake. This works as designed for the explicit handshake functions (SSL_do_handshake(), SSL_accept() and SSL_connect()), however due to a bug it does not work correctly if SSL_read() or SSL_write() is called directly. In that scenario, if the handshake fails then a fatal error will be returned in the initial function call. If SSL_read()/SSL_write() is subsequently called by the application for the same SSL object then it will succeed and the data is passed without being decrypted/encrypted directly from the SSL/TLS record layer. In order to exploit this issue an application bug would have to be present that resulted in a call to SSL_read()/SSL_write() being issued after having already received a fatal error. OpenSSL version 1.0.2b-1.0.2m are affected. Fixed in OpenSSL 1.0.2n. OpenSSL 1.1.0 is not affected. CVE-2017-3737 openSUSE Leap 42.3:python-virtualbox-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-devel-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-guest-desktop-icons-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-guest-kmp-default-5.1.36_k4.4.126_48-50.1 openSUSE Leap 42.3:virtualbox-guest-source-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-guest-tools-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-guest-x11-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-host-kmp-default-5.1.36_k4.4.126_48-50.1 openSUSE Leap 42.3:virtualbox-host-source-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-qt-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-vnc-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-websrv-5.1.36-50.1 moderate 5.4 AV:N/AC:H/Au:N/C:C/I:N/A:N Please Install the update. https://lists.opensuse.org/opensuse-security-announce/2018-04/msg00069.html https://www.suse.com/security/cve/CVE-2017-3737.html CVE-2017-3737 https://bugzilla.suse.com/1071905 SUSE Bug 1071905 https://bugzilla.suse.com/1072322 SUSE Bug 1072322 https://bugzilla.suse.com/1076369 SUSE Bug 1076369 https://bugzilla.suse.com/1089987 SUSE Bug 1089987 https://bugzilla.suse.com/1089997 SUSE Bug 1089997 Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27. The attacker sends an unauthenticated OPTIONS HTTP request when attempting to read secret data. This is a use-after-free issue and thus secret data is not always sent, and the specific data depends on many factors including configuration. Exploitation with .htaccess can be blocked with a patch to the ap_limit_section function in server/core.c. CVE-2017-9798 openSUSE Leap 42.3:python-virtualbox-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-devel-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-guest-desktop-icons-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-guest-kmp-default-5.1.36_k4.4.126_48-50.1 openSUSE Leap 42.3:virtualbox-guest-source-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-guest-tools-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-guest-x11-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-host-kmp-default-5.1.36_k4.4.126_48-50.1 openSUSE Leap 42.3:virtualbox-host-source-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-qt-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-vnc-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-websrv-5.1.36-50.1 moderate 5 AV:N/AC:L/Au:N/C:P/I:N/A:N Please Install the update. https://lists.opensuse.org/opensuse-security-announce/2018-04/msg00069.html https://www.suse.com/security/cve/CVE-2017-9798.html CVE-2017-9798 https://bugzilla.suse.com/1058058 SUSE Bug 1058058 https://bugzilla.suse.com/1060757 SUSE Bug 1060757 https://bugzilla.suse.com/1077582 SUSE Bug 1077582 https://bugzilla.suse.com/1078450 SUSE Bug 1078450 https://bugzilla.suse.com/1089997 SUSE Bug 1089997 Constructed ASN.1 types with a recursive definition (such as can be found in PKCS7) could eventually exceed the stack given malicious input with excessive recursion. This could result in a Denial Of Service attack. There are no such structures used within SSL/TLS that come from untrusted sources so this is considered safe. Fixed in OpenSSL 1.1.0h (Affected 1.1.0-1.1.0g). Fixed in OpenSSL 1.0.2o (Affected 1.0.2b-1.0.2n). CVE-2018-0739 openSUSE Leap 42.3:python-virtualbox-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-devel-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-guest-desktop-icons-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-guest-kmp-default-5.1.36_k4.4.126_48-50.1 openSUSE Leap 42.3:virtualbox-guest-source-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-guest-tools-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-guest-x11-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-host-kmp-default-5.1.36_k4.4.126_48-50.1 openSUSE Leap 42.3:virtualbox-host-source-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-qt-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-vnc-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-websrv-5.1.36-50.1 important Please Install the update. https://lists.opensuse.org/opensuse-security-announce/2018-04/msg00069.html https://www.suse.com/security/cve/CVE-2018-0739.html CVE-2018-0739 https://bugzilla.suse.com/1087102 SUSE Bug 1087102 https://bugzilla.suse.com/1089997 SUSE Bug 1089997 https://bugzilla.suse.com/1108542 SUSE Bug 1108542 Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.1.36 and Prior to 5.2.10. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H). CVE-2018-2830 openSUSE Leap 42.3:python-virtualbox-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-devel-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-guest-desktop-icons-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-guest-kmp-default-5.1.36_k4.4.126_48-50.1 openSUSE Leap 42.3:virtualbox-guest-source-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-guest-tools-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-guest-x11-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-host-kmp-default-5.1.36_k4.4.126_48-50.1 openSUSE Leap 42.3:virtualbox-host-source-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-qt-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-vnc-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-websrv-5.1.36-50.1 important Please Install the update. https://lists.opensuse.org/opensuse-security-announce/2018-04/msg00069.html https://www.suse.com/security/cve/CVE-2018-2830.html CVE-2018-2830 https://bugzilla.suse.com/1089997 SUSE Bug 1089997 Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.1.36 and Prior to 5.2.10. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle VM VirtualBox accessible data. CVSS 3.0 Base Score 3.8 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N). CVE-2018-2831 openSUSE Leap 42.3:python-virtualbox-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-devel-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-guest-desktop-icons-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-guest-kmp-default-5.1.36_k4.4.126_48-50.1 openSUSE Leap 42.3:virtualbox-guest-source-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-guest-tools-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-guest-x11-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-host-kmp-default-5.1.36_k4.4.126_48-50.1 openSUSE Leap 42.3:virtualbox-host-source-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-qt-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-vnc-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-websrv-5.1.36-50.1 important Please Install the update. https://lists.opensuse.org/opensuse-security-announce/2018-04/msg00069.html https://www.suse.com/security/cve/CVE-2018-2831.html CVE-2018-2831 https://bugzilla.suse.com/1089997 SUSE Bug 1089997 Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.1.36 and Prior to 5.2.10. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H). CVE-2018-2835 openSUSE Leap 42.3:python-virtualbox-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-devel-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-guest-desktop-icons-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-guest-kmp-default-5.1.36_k4.4.126_48-50.1 openSUSE Leap 42.3:virtualbox-guest-source-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-guest-tools-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-guest-x11-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-host-kmp-default-5.1.36_k4.4.126_48-50.1 openSUSE Leap 42.3:virtualbox-host-source-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-qt-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-vnc-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-websrv-5.1.36-50.1 important Please Install the update. https://lists.opensuse.org/opensuse-security-announce/2018-04/msg00069.html https://www.suse.com/security/cve/CVE-2018-2835.html CVE-2018-2835 https://bugzilla.suse.com/1089997 SUSE Bug 1089997 Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.1.36 and Prior to 5.2.10. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H). CVE-2018-2836 openSUSE Leap 42.3:python-virtualbox-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-devel-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-guest-desktop-icons-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-guest-kmp-default-5.1.36_k4.4.126_48-50.1 openSUSE Leap 42.3:virtualbox-guest-source-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-guest-tools-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-guest-x11-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-host-kmp-default-5.1.36_k4.4.126_48-50.1 openSUSE Leap 42.3:virtualbox-host-source-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-qt-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-vnc-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-websrv-5.1.36-50.1 important Please Install the update. https://lists.opensuse.org/opensuse-security-announce/2018-04/msg00069.html https://www.suse.com/security/cve/CVE-2018-2836.html CVE-2018-2836 https://bugzilla.suse.com/1089997 SUSE Bug 1089997 Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.1.36 and Prior to 5.2.10. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H). CVE-2018-2837 openSUSE Leap 42.3:python-virtualbox-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-devel-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-guest-desktop-icons-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-guest-kmp-default-5.1.36_k4.4.126_48-50.1 openSUSE Leap 42.3:virtualbox-guest-source-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-guest-tools-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-guest-x11-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-host-kmp-default-5.1.36_k4.4.126_48-50.1 openSUSE Leap 42.3:virtualbox-host-source-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-qt-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-vnc-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-websrv-5.1.36-50.1 important Please Install the update. https://lists.opensuse.org/opensuse-security-announce/2018-04/msg00069.html https://www.suse.com/security/cve/CVE-2018-2837.html CVE-2018-2837 https://bugzilla.suse.com/1089997 SUSE Bug 1089997 Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.1.36 and Prior to 5.2.10. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). CVE-2018-2842 openSUSE Leap 42.3:python-virtualbox-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-devel-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-guest-desktop-icons-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-guest-kmp-default-5.1.36_k4.4.126_48-50.1 openSUSE Leap 42.3:virtualbox-guest-source-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-guest-tools-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-guest-x11-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-host-kmp-default-5.1.36_k4.4.126_48-50.1 openSUSE Leap 42.3:virtualbox-host-source-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-qt-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-vnc-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-websrv-5.1.36-50.1 important Please Install the update. https://lists.opensuse.org/opensuse-security-announce/2018-04/msg00069.html https://www.suse.com/security/cve/CVE-2018-2842.html CVE-2018-2842 https://bugzilla.suse.com/1089997 SUSE Bug 1089997 Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.1.36 and Prior to 5.2.10. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). CVE-2018-2843 openSUSE Leap 42.3:python-virtualbox-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-devel-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-guest-desktop-icons-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-guest-kmp-default-5.1.36_k4.4.126_48-50.1 openSUSE Leap 42.3:virtualbox-guest-source-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-guest-tools-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-guest-x11-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-host-kmp-default-5.1.36_k4.4.126_48-50.1 openSUSE Leap 42.3:virtualbox-host-source-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-qt-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-vnc-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-websrv-5.1.36-50.1 important Please Install the update. https://lists.opensuse.org/opensuse-security-announce/2018-04/msg00069.html https://www.suse.com/security/cve/CVE-2018-2843.html CVE-2018-2843 https://bugzilla.suse.com/1089997 SUSE Bug 1089997 Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.1.36 and Prior to 5.2.10. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). CVE-2018-2844 openSUSE Leap 42.3:python-virtualbox-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-devel-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-guest-desktop-icons-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-guest-kmp-default-5.1.36_k4.4.126_48-50.1 openSUSE Leap 42.3:virtualbox-guest-source-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-guest-tools-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-guest-x11-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-host-kmp-default-5.1.36_k4.4.126_48-50.1 openSUSE Leap 42.3:virtualbox-host-source-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-qt-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-vnc-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-websrv-5.1.36-50.1 important Please Install the update. https://lists.opensuse.org/opensuse-security-announce/2018-04/msg00069.html https://www.suse.com/security/cve/CVE-2018-2844.html CVE-2018-2844 https://bugzilla.suse.com/1089997 SUSE Bug 1089997 Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.1.36 and Prior to 5.2.10. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox as well as unauthorized update, insert or delete access to some of Oracle VM VirtualBox accessible data and unauthorized read access to a subset of Oracle VM VirtualBox accessible data. CVSS 3.0 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H). CVE-2018-2845 openSUSE Leap 42.3:python-virtualbox-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-devel-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-guest-desktop-icons-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-guest-kmp-default-5.1.36_k4.4.126_48-50.1 openSUSE Leap 42.3:virtualbox-guest-source-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-guest-tools-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-guest-x11-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-host-kmp-default-5.1.36_k4.4.126_48-50.1 openSUSE Leap 42.3:virtualbox-host-source-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-qt-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-vnc-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-websrv-5.1.36-50.1 important Please Install the update. https://lists.opensuse.org/opensuse-security-announce/2018-04/msg00069.html https://www.suse.com/security/cve/CVE-2018-2845.html CVE-2018-2845 https://bugzilla.suse.com/1089997 SUSE Bug 1089997 Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.1.36 and Prior to 5.2.10. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). CVE-2018-2860 openSUSE Leap 42.3:python-virtualbox-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-devel-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-guest-desktop-icons-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-guest-kmp-default-5.1.36_k4.4.126_48-50.1 openSUSE Leap 42.3:virtualbox-guest-source-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-guest-tools-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-guest-x11-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-host-kmp-default-5.1.36_k4.4.126_48-50.1 openSUSE Leap 42.3:virtualbox-host-source-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-qt-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-vnc-5.1.36-50.1 openSUSE Leap 42.3:virtualbox-websrv-5.1.36-50.1 important Please Install the update. https://lists.opensuse.org/opensuse-security-announce/2018-04/msg00069.html https://www.suse.com/security/cve/CVE-2018-2860.html CVE-2018-2860 https://bugzilla.suse.com/1089997 SUSE Bug 1089997