Chennan

**Name of the Vulnerable Software and Affected Versions** Oracle VM VirtualBox versions prior to 6.1.20 **Description** The issue is related to insufficient input validation in the Core component of Oracle VM VirtualBox. This can allow an attacker to gain unauthorized access to protected information. The vulnerability can be easily exploited by an unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes, potentially compromising Oracle VM VirtualBox and significantly impacting additional products. Successful attacks can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. **Recommendations** For versions prior to 6.1.20, update to version 6.1.20 or later to resolve the issue. As a temporary workaround, consider restricting access to the Core component of Oracle VM VirtualBox to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Oracle VM VirtualBox versions prior to 6.1.20 Description: The issue is related to insufficient input validation in the Core component of Oracle VM VirtualBox. This can allow an attacker to gain unauthorized access to protected information. The vulnerability can be easily exploited by an unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes, potentially compromising Oracle VM VirtualBox and significantly impacting additional products. Successful attacks can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. Recommendations: For versions prior to 6.1.20, update to version 6.1.20 or later to resolve the issue. As a temporary workaround, consider restricting access to the Core component of Oracle VM VirtualBox to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Oracle VM VirtualBox versions prior to 6.1.20 Description: The issue is related to insufficient input validation in the Core component of Oracle VM VirtualBox, allowing an unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise it. This can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. The vulnerability may significantly impact additional products. Recommendations: For versions prior to 6.1.20, update to version 6.1.20 or later to resolve the issue. As a temporary workaround, consider restricting access to the Core component of Oracle VM VirtualBox to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Oracle VM VirtualBox versions prior to 6.1.20 **Description** The issue is related to insufficient input validation in the Core component of Oracle VM VirtualBox. This can allow an attacker to gain unauthorized access to modify, add, or delete data. Successful attacks can result in unauthorized creation, deletion, or modification access to critical data or all Oracle VM VirtualBox accessible data. **Recommendations** For versions prior to 6.1.20, update to version 6.1.20 or later to resolve the issue. As a temporary workaround, consider restricting access to the Core component of Oracle VM VirtualBox to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Oracle VM VirtualBox versions prior to 6.1.20 Description: The issue is related to insufficient input validation in the Core component of Oracle VM VirtualBox, allowing an unauthenticated attacker with logon to the infrastructure to compromise Oracle VM VirtualBox. Successful attacks can result in unauthorized creation, deletion, or modification access to critical data or all Oracle VM VirtualBox accessible data. This vulnerability may significantly impact additional products. Recommendations: For versions prior to 6.1.20, update to version 6.1.20 or later to resolve the issue. As a temporary workaround, consider restricting access to the Core component of Oracle VM VirtualBox to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Oracle VM VirtualBox versions prior to 6.1.20 Description: The issue is related to insufficient input validation in the Core component of Oracle VM VirtualBox. This can allow an attacker to gain unauthorized access to protected information. The vulnerability is easily exploitable and can be used by an unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes. Successful attacks can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. Recommendations: For versions prior to 6.1.20, update to version 6.1.20 or later to resolve the issue. As a temporary workaround, consider restricting access to the Core component of Oracle VM VirtualBox to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Oracle VM VirtualBox versions prior to 6.1.20 Description: The issue is related to insufficient input validation in the Core component of Oracle VM VirtualBox, which can allow an attacker to gain unauthorized access to protected information. This vulnerability can be easily exploited by a high-privileged attacker with logon access to the infrastructure where Oracle VM VirtualBox is executed, potentially compromising Oracle VM VirtualBox and impacting additional products. Successful attacks can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. Recommendations: For versions prior to 6.1.20, update to version 6.1.20 or later to resolve the issue. As a temporary workaround, consider restricting access to the Core component of Oracle VM VirtualBox to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Oracle VM VirtualBox versions prior to 6.1.20 **Description** The issue is related to insufficient input validation in the Core component of Oracle VM VirtualBox, which can allow an attacker to gain unauthorized access to protected information. Successful attacks can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. The vulnerability can be easily exploited by an unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes. **Recommendations** For versions prior to 6.1.20, update to version 6.1.20 or later to resolve the issue. As a temporary workaround, consider restricting access to the Core component of Oracle VM VirtualBox to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Oracle VM VirtualBox versions prior to 6.1.18 **Description** The issue is related to insufficient input validation in the Core component of Oracle VM VirtualBox, allowing a high-privileged attacker with logon to the infrastructure to compromise Oracle VM VirtualBox. Successful attacks can result in unauthorized ability to cause a hang or frequently repeatable crash of Oracle VM VirtualBox, potentially impacting additional products. **Recommendations** For versions prior to 6.1.18, update to version 6.1.18 or later to resolve the issue. As a temporary workaround, consider restricting access to the Core component of Oracle VM VirtualBox to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Oracle VM VirtualBox versions prior to 6.1.18 Description: The issue is related to insufficient input validation in the Core component of Oracle VM VirtualBox, allowing a highly privileged attacker with logon access to the infrastructure where Oracle VM VirtualBox executes to compromise it. Successful attacks can result in unauthorized creation, deletion, or modification access to critical data or all Oracle VM VirtualBox accessible data. Although the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Recommendations: For versions prior to 6.1.18, update to version 6.1.18 or later to resolve the issue. As a temporary workaround, consider restricting access to the Core component of Oracle VM VirtualBox to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Oracle VM VirtualBox versions prior to 6.1.18 Description: The issue exists due to insufficient input validation in the Core component of Oracle VM VirtualBox. Exploitation of this issue may allow an attacker to compromise the confidentiality and integrity of protected information. Successful attacks can result in unauthorized creation, deletion, or modification access to critical data or all Oracle VM VirtualBox accessible data, as well as unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. Recommendations: For versions prior to 6.1.18, update to version 6.1.18 or later to resolve the issue. As a temporary workaround, consider restricting access to the Core component of Oracle VM VirtualBox to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Oracle VM VirtualBox versions prior to 6.1.18 Description: The issue is related to insufficient input validation in the Core component of Oracle VM VirtualBox, allowing a high-privileged attacker with logon to the infrastructure to compromise Oracle VM VirtualBox. This can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. Attacks may significantly impact additional products. Recommendations: For versions prior to 6.1.18, update to version 6.1.18 or later to resolve the issue. As a temporary workaround, consider restricting access to the Core component of Oracle VM VirtualBox to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Oracle VM VirtualBox versions prior to 6.1.18 Description: The issue exists due to insufficient input validation in the Core component of Oracle VM VirtualBox. Exploitation of this issue can allow an attacker to impact the confidentiality and integrity of protected information. A high-privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes can compromise Oracle VM VirtualBox, and successful attacks can result in unauthorized update, insert, or delete access to some of Oracle VM VirtualBox's accessible data, as well as unauthorized read access to a subset of Oracle VM VirtualBox's accessible data. Recommendations: For versions prior to 6.1.18, update to version 6.1.18 or later to resolve the issue. As a temporary workaround, consider restricting access to the Core component of Oracle VM VirtualBox to minimize the risk of exploitation. Restrict logon to the infrastructure where Oracle VM VirtualBox executes to high-privileged attackers only.

Name of the Vulnerable Software and Affected Versions: Oracle VM VirtualBox versions prior to 6.1.18 Description: The issue is related to insufficient input validation in the Core component of Oracle VM VirtualBox, allowing a high-privileged attacker with logon access to the infrastructure to compromise Oracle VM VirtualBox. Successful attacks can result in unauthorized creation, deletion, or modification access to critical data or all Oracle VM VirtualBox accessible data. This vulnerability may significantly impact additional products. Recommendations: For versions prior to 6.1.18, update to version 6.1.18 or later to resolve the issue. As a temporary workaround, consider restricting access to the Core component of Oracle VM VirtualBox to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Oracle VM VirtualBox versions prior to 6.1.18 **Description** The issue is related to insufficient input validation in the Core component of Oracle VM VirtualBox, allowing a highly privileged attacker with logon to the infrastructure to compromise Oracle VM VirtualBox. This can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. Although the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. **Recommendations** For versions prior to 6.1.18, update to version 6.1.18 or later to resolve the issue. As a temporary workaround, consider restricting access to the Core component of Oracle VM VirtualBox to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Oracle VM VirtualBox versions prior to 6.1.18 **Description** The issue is related to insufficient access control in the Core component of Oracle VM VirtualBox, allowing a high-privileged attacker with logon access to the infrastructure to compromise Oracle VM VirtualBox. Successful attacks can result in unauthorized ability to cause a hang or frequently repeatable crash of Oracle VM VirtualBox, potentially impacting additional products. **Recommendations** For versions prior to 6.1.18, update to version 6.1.18 or later to resolve the issue. As a temporary workaround, consider restricting access to the Core component to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Oracle VM VirtualBox versions prior to 6.1.18 **Description** The issue is related to insufficient access control in the Core component of Oracle VM VirtualBox, allowing a high-privileged attacker with logon to the infrastructure to compromise Oracle VM VirtualBox. Successful attacks can result in unauthorized ability to cause a hang or frequently repeatable crash of Oracle VM VirtualBox, potentially impacting additional products. **Recommendations** For versions prior to 6.1.18, update to version 6.1.18 or later to resolve the issue. As a temporary workaround, consider restricting access to the Core component to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Oracle VM VirtualBox versions prior to 6.1.18 Description: The issue is related to insufficient access control in the Core component of Oracle VM VirtualBox, allowing a high-privileged attacker with logon to the infrastructure to compromise Oracle VM VirtualBox. Successful attacks can result in unauthorized ability to cause a hang or frequently repeatable crash of Oracle VM VirtualBox, potentially impacting additional products. Recommendations: For versions prior to 6.1.18, update to version 6.1.18 or later to resolve the issue. As a temporary workaround, consider restricting access to the Core component to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 5.9-rc7 **Description** A flaw in the HDLC PPP module of the Linux kernel causes memory corruption and a read overflow due to improper input validation in the `ppp cp parse cr` function. This can lead to a system crash or denial of service, posing a threat to data confidentiality, integrity, and system availability. The vulnerability can be exploited by a remote attacker to cause a denial of service. **Recommendations** For Linux kernel versions prior to 5.9-rc7, update to version 5.9-rc7 or later to resolve the issue. As a temporary workaround, consider restricting access to the HDLC PPP module to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** HoRNDIS versions (affected versions not specified) **Description** The issue is caused by an integer overflow in the RNDIS packet parsing routines, allowing a malicious USB device to trigger disclosure of unrelated kernel memory to userspace applications on the host or cause the kernel to crash. Kernel memory disclosure is more likely on 32-bit kernels, while 64-bit kernels are more likely to crash during attempted exploitation. The vulnerability is located in the `HoRNDIS::receivePacket` function, where variables `msg len`, `data ofs`, and `data len` can be controlled by an attached USB device. A negative value of `data ofs` can bypass the check for `(data ofs + data len + 8) > msg len`, leading to a wild pointer copy in the `mbuf copyback` call. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting the use of HoRNDIS to only trusted USB devices, especially in multi-tenant systems.