MGASA-2018-0360 - Updated virtualbox packages fix security vulnerabilities

Publication date: 31 Aug 2018
URL: https://advisories.mageia.org/MGASA-2018-0360.html
Type: security
Affected Mageia releases: 6
CVE: CVE-2018-3005,
     CVE-2018-3055,
     CVE-2018-3085,
     CVE-2018-3086,
     CVE-2018-3087,
     CVE-2018-3088,
     CVE-2018-3089,
     CVE-2018-3090,
     CVE-2018-3091

This update provides the virtualbox 5.1.18 maintenance release that
fixes atleast the following security issues:

Fixed an easily exploitable vulnerability that allowed unauthenticated
attacker with logon to the infrastructure where Oracle VM VirtualBox
executes to compromise Oracle VM VirtualBox. Successful attacks of this
vulnerability can result in unauthorized ability to cause a partial denial
of service (partial DOS) of Oracle VM VirtualBox (CVE-2018-3005).

Fixed an easily exploitable vulnerability that allowed unauthenticated
attacker with logon to the infrastructure where Oracle VM VirtualBox
executes to compromise Oracle VM VirtualBox. Successful attacks require
human interaction from a person other than the attacker and while the
vulnerability is in Oracle VM VirtualBox, attacks may significantly impact
additional products. Successful attacks of this vulnerability can result
in unauthorized ability to cause a hang or frequently repeatable crash
(complete DOS) of Oracle VM VirtualBox and unauthorized read access to a
subset of Oracle VM VirtualBox accessible data (CVE-2018-3055).

Fixed an easily exploitable vulnerability that allowed unauthenticated
attacker with logon to the infrastructure where Oracle VM VirtualBox
executes to compromise Oracle VM VirtualBox. Successful attacks require
human interaction from a person other than the attacker and while the
vulnerability is in Oracle VM VirtualBox, attacks may significantly impact
additional products. Successful attacks of this vulnerability can result
in unauthorized creation, deletion or modification access to critical data
or all Oracle VM VirtualBox accessible data as well as unauthorized read
access to a subset of Oracle VM VirtualBox accessible data and unauthorized
ability to cause a hang or frequently repeatable crash (complete DOS) of
Oracle VM VirtualBox (CVE-2018-3085).

Fixed an easily exploitable vulnerability that allowed unauthenticated
attacker with logon to the infrastructure where Oracle VM VirtualBox
executes to compromise Oracle VM VirtualBox. Successful attacks require
human interaction from a person other than the attacker and while the
vulnerability is in Oracle VM VirtualBox, attacks may significantly impact
additional products. Successful attacks of this vulnerability can result
in takeover of Oracle VM VirtualBox (CVE-2018-3086, CVE-2018-3087,
CVE-2018-3088, CVE-2018-3089, CVE-2018-3090).

Fixed an easily exploitable vulnerability allows unauthenticated attacker
with logon to the infrastructure where Oracle VM VirtualBox executes to
compromise Oracle VM VirtualBox. Successful attacks require human
interaction from a person other than the attacker and while the
vulnerability is in Oracle VM VirtualBox, attacks may significantly impact
additional products. Successful attacks of this vulnerability can result
in unauthorized access to critical data or complete access to all Oracle
VM VirtualBox accessible data (CVE-2018-3091).

For other fixes in this update, see the referenced changelog.

References:
- https://bugs.mageia.org/show_bug.cgi?id=23421
- https://www.oracle.com/security-alerts/cpujul2018.html
- - https://www.virtualbox.org/wiki/Changelog#18
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3005
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3055
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3085
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3086
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3087
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3088
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3089
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3090
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3091

SRPMS:
- 6/core/virtualbox-5.2.18-1.mga6
- 6/core/kmod-virtualbox-5.2.18-1.mga6
- 6/core/kmod-vboxadditions-5.2.18-1.mga6