openSUSE Security Update: Security update for virtualbox
______________________________________________________________________________

Announcement ID:    openSUSE-SU-2024:0364-1
Rating:             important
References:         #1231225 #1231735 #1231736 #1231737 #1231738 
                    
Cross-References:   CVE-2024-21248 CVE-2024-21259 CVE-2024-21263
                    CVE-2024-21273
Affected Products:
                    openSUSE Backports SLE-15-SP6
                    openSUSE Leap 15.6
______________________________________________________________________________

   An update that solves four vulnerabilities and has one
   errata is now available.

Description:

   This update for virtualbox fixes the following issues:

   Update to release 7.1.4:

   * NAT: Fixed DHCP problems with certain guests when domain is empty
   * VMSVGA: Improved flickering, black screen and other screen update issues
     with recent Linux kernels
   * Linux Guest Additions: Introduce initial support for kernel 6.12
   * EFI: Added missing LsiLogic MPT SCSI driver again to fix booting from
     devices attached to this device if the EFI firmware is used (7.1.0
     regression)
   * EFI: Restored broken network boot support (7.1.0 regression)
   * Adressed CVE-2024-21248 [boo#1231735], CVE-2024-21273 [boo#1231736],
     CVE-2024-21259 [boo#1231737], CVE-2024-21263 [boo#1231738]

   - Make the Extension Pack work with our compiler flags and RT_NOEXCEPT
     choices. [boo#1231225]

   Update to release 7.1:

   * The GUI now offers a selection between Basic and Experienced user level
     with reduced or full UI functionality.
   * VRDE: If user does not set up TLS with custom certificates, enable it
     with self-signed certificate, including issuing a new one before the old
     one expires
   * NAT: New engine with IPv6 support.
   * Linux host and guest: Added Wayland support for Clipboard sharing.

   - Changed license from Gpl-2.0 to Gpl-3.0

   Version bump to VirtualBox 7.0.20 (released July 16 2024 by Oracle))

   This is a maintenance release. The following items were fixed and/or added:

   - TPM: Fixed errors appearing the event viewer with Windows guests
   - macOS Hosts: Fixed passing USB devices to the VM (bug #21218)
   - Audio: Fixed recording with HDA emulation after newer Windows 10 / 11
     guests got rebooted
   - USB: Fixed a deadlock in OHCI triggered when saving the current state of
     a VM or taking a snapshot (bug #22059)
   - Linux Guest and Host: Introduced initial support for OpenSuse 15.6 kernel
   - Linux Guest and Host: Introduced initial support for RHEL 9.5 kernel
     (bug #22099)
   - Guest Additions: Shared Clipboard: Fixed issue when extra new lines were
     pasted when copying text between Win and X11 (bug #21716)
   - UEFI Secure Boot: Add new Microsoft certificates to list for new VMs


Patch Instructions:

   To install this openSUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - openSUSE Leap 15.6:

      zypper in -t patch openSUSE-2024-364=1

   - openSUSE Backports SLE-15-SP6:

      zypper in -t patch openSUSE-2024-364=1



Package List:

   - openSUSE Leap 15.6 (x86_64):

      python3-virtualbox-7.1.4-lp156.2.4.1
      python3-virtualbox-debuginfo-7.1.4-lp156.2.4.1
      virtualbox-7.1.4-lp156.2.4.1
      virtualbox-debuginfo-7.1.4-lp156.2.4.1
      virtualbox-debugsource-7.1.4-lp156.2.4.1
      virtualbox-devel-7.1.4-lp156.2.4.1
      virtualbox-guest-tools-7.1.4-lp156.2.4.1
      virtualbox-guest-tools-debuginfo-7.1.4-lp156.2.4.1
      virtualbox-kmp-debugsource-7.1.4-lp156.2.4.1
      virtualbox-kmp-default-7.1.4_k6.4.0_150600.23.25-lp156.2.4.1
      virtualbox-kmp-default-debuginfo-7.1.4_k6.4.0_150600.23.25-lp156.2.4.1
      virtualbox-qt-7.1.4-lp156.2.4.1
      virtualbox-qt-debuginfo-7.1.4-lp156.2.4.1
      virtualbox-vnc-7.1.4-lp156.2.4.1
      virtualbox-websrv-7.1.4-lp156.2.4.1
      virtualbox-websrv-debuginfo-7.1.4-lp156.2.4.1

   - openSUSE Leap 15.6 (noarch):

      virtualbox-guest-desktop-icons-7.1.4-lp156.2.4.1
      virtualbox-guest-source-7.1.4-lp156.2.4.1
      virtualbox-host-source-7.1.4-lp156.2.4.1

   - openSUSE Backports SLE-15-SP6 (aarch64 ppc64le x86_64):

      kbuild-0.1.9998+svn3613-bp156.2.3.1
      kbuild-debuginfo-0.1.9998+svn3613-bp156.2.3.1
      kbuild-debugsource-0.1.9998+svn3613-bp156.2.3.1


References:

   https://www.suse.com/security/cve/CVE-2024-21248.html
   https://www.suse.com/security/cve/CVE-2024-21259.html
   https://www.suse.com/security/cve/CVE-2024-21263.html
   https://www.suse.com/security/cve/CVE-2024-21273.html
   https://bugzilla.suse.com/1231225
   https://bugzilla.suse.com/1231735
   https://bugzilla.suse.com/1231736
   https://bugzilla.suse.com/1231737
   https://bugzilla.suse.com/1231738