advisories/10736.adv

type: security
subject: Updated virtualbox package fixes security issue
CVE:
 - CVE-2013-3792
src:
  2:
   core:
     - kmod-vboxadditions-4.2.16-1.mga2
     - kmod-virtualbox-4.2.16-1.mga2
     - virtualbox-4.2.16-1.mga2
  3:
   core:
     - kmod-vboxadditions-4.2.16-1.mga3
     - kmod-virtualbox-4.2.16-1.mga3
     - virtualbox-4.2.16-1.mga3
description: |
  This virtualbox update provides the 4.2.16 maintenance release,
  which fixes the following security issue:
  
  Thomas Dreibholz has discovered a vulnerability in Oracle VirtualBox,
  which can be exploited by malicious, local users in a guest virtual
  machine to cause a DoS (Denial of Service).
  The vulnerability is caused due to an unspecified error and can be
  exploited to render the host network connection and the virtual machine
  instance unresponsive or locking the host by issuing e.g. the "tracepath"
  command.
  Successful exploitation requires the target virtual machine to be
  equipped with a paravirtualised network adapter (virtio-net).
  (CVE-2013-3792)
  
  For other changes in this update, see the referenced changelog.
references:
 - https://bugs.mageia.org/show_bug.cgi?id=10736
 - https://www.virtualbox.org/wiki/Changelog
 - https://www.virtualbox.org/ticket/11863
ID: MGASA-2013-0222
1	type: security
2	subject: Updated virtualbox package fixes security issue
3	CVE:
4	- CVE-2013-3792
5	src:
6	2:
7	core:
8	- kmod-vboxadditions-4.2.16-1.mga2
9	- kmod-virtualbox-4.2.16-1.mga2
10	- virtualbox-4.2.16-1.mga2
11	3:
12	core:
13	- kmod-vboxadditions-4.2.16-1.mga3
14	- kmod-virtualbox-4.2.16-1.mga3
15	- virtualbox-4.2.16-1.mga3
16	description: \|
17	This virtualbox update provides the 4.2.16 maintenance release,
18	which fixes the following security issue:
19
20	Thomas Dreibholz has discovered a vulnerability in Oracle VirtualBox,
21	which can be exploited by malicious, local users in a guest virtual
22	machine to cause a DoS (Denial of Service).
23	The vulnerability is caused due to an unspecified error and can be
24	exploited to render the host network connection and the virtual machine
25	instance unresponsive or locking the host by issuing e.g. the "tracepath"
26	command.
27	Successful exploitation requires the target virtual machine to be
28	equipped with a paravirtualised network adapter (virtio-net).
29	(CVE-2013-3792)
30
31	For other changes in this update, see the referenced changelog.
32	references:
33	- https://bugs.mageia.org/show_bug.cgi?id=10736
34	- https://www.virtualbox.org/wiki/Changelog
35	- https://www.virtualbox.org/ticket/11863
36	ID: MGASA-2013-0222