Ubuntu
virtualbox-ose package

CVE-2011-2305

Bug #816874 reported by Felix Geyer
260
This bug affects 1 person
Affects Status Importance Assigned to Milestone
virtualbox-ose (Debian)
Fix Released
Unknown
virtualbox-ose (Ubuntu)
Invalid
Undecided
Unassigned
Natty
Fix Released
Undecided
Steve Beattie

Bug Description

According to http://mista.nu/blog/2011/07/19/oracle-virtualbox-integer-overflow-vulnerabilities/ CVE-2011-2305 might allow a guest VM to execute code on the host.

The version information in the CVE are wrong. The issue affects 4.0.0 - 4.0.8.
So the package needs to be updated in natty and natty-backports (virtualbox source package).

CVE References

Felix Geyer (debfx)
visibility: private → public
Changed in virtualbox-ose (Ubuntu):
status: New → Invalid
Revision history for this message
Felix Geyer (debfx) wrote :

virtualbox-ose (4.0.4-dfsg-1ubuntu4.1) natty-security; urgency=low

  * SECURITY UPDATE: possible arbitrary code execution on the host (LP: #816874)
    - debian/patches/31-CVE-2011-2305.patch: patch from upstream
    - CVE-2011-2305

 -- Felix Geyer <email address hidden> Wed, 27 Jul 2011 11:45:28 +0200

Steve Beattie (sbeattie)
Changed in virtualbox-ose (Ubuntu Natty):
status: New → In Progress
assignee: nobody → Steve Beattie (sbeattie)
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package virtualbox-ose - 4.0.4-dfsg-1ubuntu4.1

---------------
virtualbox-ose (4.0.4-dfsg-1ubuntu4.1) natty-security; urgency=low

  * SECURITY UPDATE: possible arbitrary code execution on the host (LP: #816874)
    - debian/patches/31-CVE-2011-2305.patch: patch from upstream
    - CVE-2011-2305
 -- Felix Geyer <email address hidden> Wed, 27 Jul 2011 11:45:28 +0200

Changed in virtualbox-ose (Ubuntu Natty):
status: In Progress → Fix Released
Bug Watch Updater (bug-watch-updater)
Changed in virtualbox-ose (Debian):
status: Unknown → Fix Released
To post a comment you must log in.
This report contains Public Security information  
Everyone can see this security related information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.