MGASA-2014-0185
- Source
- https://advisories.mageia.org/MGASA-2014-0185.html
- Import Source
- https://advisories.mageia.org/MGASA-2014-0185.json
- JSON Data
- https://api.osv.dev/v1/vulns/MGASA-2014-0185
- Upstream
- Published
- 2014-04-20T18:54:57Z
- Modified
- 2026-04-16T06:24:23.769886071Z
- Summary
- Updated virtualbox packages fixes security vulnerabilities
- Details
-
VBox/GuestHost/OpenGL/util/net.c in Oracle VirtualBox before 3.2.22, 4.0.x before 4.0.24, 4.1.x before 4.1.32, 4.2.x before 4.2.24, and 4.3.x before 4.3.8, when using 3D Acceleration allows local guest OS users to execute arbitrary code on the Chromium server via crafted Chromium network pointer in a CRMESSAGEREADBACK or CRMESSAGEWRITEBACK message to the VBoxSharedCrOpenGL service, which triggers an arbitrary pointer dereference and memory corruption (CVE-2014-0981).
Multiple array index errors in programs that are automatically generated by VBox/HostServices/SharedOpenGL/crserverlib/serverdispatch.py in Oracle VirtualBox 4.2.x through 4.2.20 and 4.3.x before 4.3.8, when using 3D Acceleration, allow local guest OS users to execute arbitrary code on the Chromium server via certain CRMESSAGE_OPCODES messages with a crafted index, which are not properly handled (CVE-2014-0983).
The virtualbox packages has been updated to 4.3.10 maintenance release that resolves theese issues and other upstream reported issues (for more info check the referenced changelog).
This update also resolves the following: - load virtualbox modules on install (mga#8826) - missing GUI translations (mga#12578)
- References
- Credits
-
-
- Mageia - COORDINATOR
-
Affected packages
Mageia:4 / kmod-vboxadditions
Package
- Name
- kmod-vboxadditions
- Purl
- pkg:rpm/mageia/kmod-vboxadditions?arch=source&distro=mageia-4
Mageia:4 / kmod-virtualbox
Package
- Name
- kmod-virtualbox
- Purl
- pkg:rpm/mageia/kmod-virtualbox?arch=source&distro=mageia-4
Mageia:4 / virtualbox
Package
- Name
- virtualbox
- Purl
- pkg:rpm/mageia/virtualbox?arch=source&distro=mageia-4