openSUSE-SU-2021:0630-1

See a problem?
Import Source
https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2021:0630-1.json
JSON Data
https://api.osv.dev/v1/vulns/openSUSE-SU-2021:0630-1
Upstream
CVE (3)
  • CVE-2021-2074
  • CVE-2021-2129
  • CVE-2021-2264
Related
CVE (3)
  • CVE-2021-2074
  • CVE-2021-2129
  • CVE-2021-2264
Published
2021-04-30T19:22:36Z
Modified
2026-02-04T04:10:45Z
Summary
Security update for virtualbox
Details

This update for virtualbox fixes the following issues:

  • Version bump to 6.1.20 (released April 20 2021 by Oracle) Fixes boo#1183329 'virtualbox 6.1.18 crashes when it runs nested VM' Fixes boo#1183125 'Leap 15.3 installation in Virtualbox without VBox integration' Fixes CVE-2021-2264 and boo#1184542. The directory for the .start files for autostarting VMs is moved from /etc/vbox to /etc/vbox/autostart.d. In addition, the autostart service is hardened (by Oracle).
  • change the modalias for guest-tools and guest-x11 to get them to autoinstall.
  • Own %{_sysconfdir}/X11/xinit/xinitrc.d as default packages (eg systemd) no longer do so, breaking package build.
  • Update fixes_for_leap15.3 for kernel API changes between 5.3.18-45 and 5.3.18-47.
  • update-extpack.sh: explicitly use https:// protocol for authenticity. The http:// URL is currently redirected to https:// but don't rely on this.
  • Add code to generate guest modules for Leap 15.2 and Leap 15.3. The kernel versions do not allow window resizing. Files 'virtualbox-kmp-files-leap' and 'vboxguestconfig.sh' are added
  • Fixes CVE-2021-2074, boo#1181197 and CVE-2021-2129, boo#1181198.
  • Under some circumstances, shared folders are mounted as root.
References

Affected packages

openSUSE:Leap 15.2 / virtualbox

Package

Name
virtualbox
Purl
pkg:rpm/opensuse/virtualbox&distro=openSUSE%20Leap%2015.2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
6.1.20-lp152.2.21.1

Ecosystem specific 

{
    "binaries":  [
        {
            "python3-virtualbox":  "6.1.20-lp152.2.21.1",
            "virtualbox":  "6.1.20-lp152.2.21.1",
            "virtualbox-devel":  "6.1.20-lp152.2.21.1",
            "virtualbox-guest-desktop-icons":  "6.1.20-lp152.2.21.1",
            "virtualbox-guest-source":  "6.1.20-lp152.2.21.1",
            "virtualbox-guest-tools":  "6.1.20-lp152.2.21.1",
            "virtualbox-guest-x11":  "6.1.20-lp152.2.21.1",
            "virtualbox-host-source":  "6.1.20-lp152.2.21.1",
            "virtualbox-kmp-default":  "6.1.20_k5.3.18_lp152.72-lp152.2.21.1",
            "virtualbox-kmp-preempt":  "6.1.20_k5.3.18_lp152.72-lp152.2.21.1",
            "virtualbox-qt":  "6.1.20-lp152.2.21.1",
            "virtualbox-vnc":  "6.1.20-lp152.2.21.1",
            "virtualbox-websrv":  "6.1.20-lp152.2.21.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2021:0630-1.json"

openSUSE:Leap 15.2 / virtualbox-kmp

Package

Name
virtualbox-kmp
Purl
pkg:rpm/opensuse/virtualbox-kmp&distro=openSUSE%20Leap%2015.2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
6.1.20-lp152.2.21.1

Ecosystem specific 

{
    "binaries":  [
        {
            "python3-virtualbox":  "6.1.20-lp152.2.21.1",
            "virtualbox":  "6.1.20-lp152.2.21.1",
            "virtualbox-devel":  "6.1.20-lp152.2.21.1",
            "virtualbox-guest-desktop-icons":  "6.1.20-lp152.2.21.1",
            "virtualbox-guest-source":  "6.1.20-lp152.2.21.1",
            "virtualbox-guest-tools":  "6.1.20-lp152.2.21.1",
            "virtualbox-guest-x11":  "6.1.20-lp152.2.21.1",
            "virtualbox-host-source":  "6.1.20-lp152.2.21.1",
            "virtualbox-kmp-default":  "6.1.20_k5.3.18_lp152.72-lp152.2.21.1",
            "virtualbox-kmp-preempt":  "6.1.20_k5.3.18_lp152.72-lp152.2.21.1",
            "virtualbox-qt":  "6.1.20-lp152.2.21.1",
            "virtualbox-vnc":  "6.1.20-lp152.2.21.1",
            "virtualbox-websrv":  "6.1.20-lp152.2.21.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2021:0630-1.json"