CVE-2014-0981

Oracle VM Virtualbox - Resource Management Error

Title source: rule
STIX 2.1

Description

VBox/GuestHost/OpenGL/util/net.c in Oracle VirtualBox before 3.2.22, 4.0.x before 4.0.24, 4.1.x before 4.1.32, 4.2.x before 4.2.24, and 4.3.x before 4.3.8, when using 3D Acceleration allows local guest OS users to execute arbitrary code on the Chromium server via crafted Chromium network pointer in a (1) CR_MESSAGE_READBACK or (2) CR_MESSAGE_WRITEBACK message to the VBoxSharedCrOpenGL service, which triggers an arbitrary pointer dereference and memory corruption. NOTE: this issue was MERGED with CVE-2014-0982 because it is the same type of vulnerability affecting the same set of versions. All CVE users should reference CVE-2014-0981 instead of CVE-2014-0982.

Exploits (1)

exploitdb WRITEUP VERIFIED
by Core Security · textdosmultiple
https://www.exploit-db.com/exploits/32208

References (9)

Core 9
Core References
Exploit, Third Party Advisory exploit x_refsource_exploit-db
http://www.exploit-db.com/exploits/32208
Third Party Advisory vendor-advisory x_refsource_gentoo
https://security.gentoo.org/glsa/201612-27
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/57384
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/531418/100/0/threaded
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2014/dsa-2904
Various Sources x_refsource_confirm
https://www.virtualbox.org/changeset/50437/vbox
Exploit mailing-list x_refsource_fulldisc
http://seclists.org/fulldisclosure/2014/Mar/95

Scores

EPSS 0.0648
EPSS Percentile 91.1%

Details

CWE
CWE-399
Status published
Products (15)
oracle/vm_virtualbox 4.2.0
oracle/vm_virtualbox 4.2.2
oracle/vm_virtualbox 4.2.4
oracle/vm_virtualbox 4.2.6
oracle/vm_virtualbox 4.2.8
oracle/vm_virtualbox 4.2.10
oracle/vm_virtualbox 4.2.12
oracle/vm_virtualbox 4.2.14
oracle/vm_virtualbox 4.2.16
oracle/vm_virtualbox 4.2.18
... and 5 more
Published Mar 31, 2014
Tracked Since Feb 18, 2026