Mageia alert MGASA-2025-0002 (virtualbox & kmod-virtualbox)

From:
             
 
Mageia Updates <updates-announce@ml.mageia.org>
To:
             
 
updates-announce@ml.mageia.org
Subject:
             
 
[updates-announce] MGASA-2025-0002: Updated virtualbox & kmod-virtualbox packages fix security vulnerabilities
Date:
             
 
Sat, 04 Jan 2025 22:10:10 +0100
Message-ID:
             
 
<20250104211010.605AAA0D6E@duvel.mageia.org>
Archive-link:
             
 
Article
MGASA-2025-0002 - Updated virtualbox & kmod-virtualbox packages fix security vulnerabilities

Publication date: 04 Jan 2025
URL: https://advisories.mageia.org/MGASA-2025-0002.html
Type: security
Affected Mageia releases: 9
CVE: CVE-2024-21259,
     CVE-2024-21263,
     CVE-2024-21273,
     CVE-2024-21248,
     CVE-2024-21253

Description:
Vulnerabilities were found in the Oracle VM VirtualBox product of Oracle
Virtualization (component: Core). Supported versions that are affected
are prior to 7.0.22 and prior to 7.1.2. A difficult to exploit
vulnerability allows a high privileged attacker with logon to the
infrastructure where Oracle VM VirtualBox executes to compromise an Oracle
VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox,
attacks may significantly impact additional products (scope change).
Successful attacks of this vulnerability can result in takeover of
Oracle VirtualBox VMs. CVSS 3.1 Base Score 7.5 (Confidentiality,
Integrity and Availability impacts). CVSS Vector:
(CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).

References:
- https://bugs.mageia.org/show_bug.cgi?id=33754
- https://www.oracle.com/security-alerts/cpuoct2024.html#Ap...
- https://www.virtualbox.org/wiki/Changelog-7.0#v22
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2...
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2...
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2...
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2...
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2...

SRPMS:
- 9/core/virtualbox-7.0.22-1.mga9
- 9/core/kmod-virtualbox-7.0.22-62.mga9