Test ID:	1.3.6.1.4.1.25623.1.1.10.2020.0466
Category:	Mageia Linux Local Security Checks
Title:	Mageia: Security Advisory (MGASA-2020-0466)
Summary:	The remote host is missing an update for the 'kmod-virtualbox, virtualbox' package(s) announced via the MGASA-2020-0466 advisory.
Description:	Summary: The remote host is missing an update for the 'kmod-virtualbox, virtualbox' package(s) announced via the MGASA-2020-0466 advisory. Vulnerability Insight: Vulnerabilities in the Oracle VM VirtualBox are fixed in version 6.1.16. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability which can lead to execute code in the context of the hypervisor. (CVE-2020-14872). An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the shader_generate_main function. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the hypervisor. (CVE-2020-14881). An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the shader_record_register_usage function. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the hypervisor. (CVE-2020-14884). An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the shader_generate_main function. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the hypervisor. (CVE-2020-14885). An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the shader_skip_unrecognized function. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the hypervisor. (CVE-2020-14886). An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability which can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. (CVE-2020-14889). An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability which result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. (CVE-2020-14892). Also this updated version has some bugfix (See upstream Changelog). Affected Software/OS: 'kmod-virtualbox, virtualbox' package(s) on Mageia 7. Solution: Please install the updated package(s). CVSS Score: 7.2 CVSS Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2020-14872 https://security.gentoo.org/glsa/202101-15 https://www.oracle.com/security-alerts/cpuoct2020.html Common Vulnerability Exposure (CVE) ID: CVE-2020-14881 https://www.zerodayinitiative.com/advisories/ZDI-20-1278/ Common Vulnerability Exposure (CVE) ID: CVE-2020-14884 https://www.zerodayinitiative.com/advisories/ZDI-20-1279/ Common Vulnerability Exposure (CVE) ID: CVE-2020-14885 https://www.zerodayinitiative.com/advisories/ZDI-20-1281/ Common Vulnerability Exposure (CVE) ID: CVE-2020-14886 https://www.zerodayinitiative.com/advisories/ZDI-20-1280/ Common Vulnerability Exposure (CVE) ID: CVE-2020-14889 Common Vulnerability Exposure (CVE) ID: CVE-2020-14892
Copyright	Copyright (C) 2022 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.