Bug 386317 (CVE-2010-4414) – <app-emulation/virtualbox{,-bin}-4.1.4: multiple vulnerabilities (CVE-2010-4414,CVE-2011-{2300,2305})

• Product: Gentoo Security
• Status: RESOLVED FIXED

[Description GLSAMaker/CVETool Bot 2011-10-08 14:11:40 UTC]

CVE-2011-2305 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2305):
  Unspecified vulnerability in Oracle VM VirtualBox 3.0, 3.1, 3.2, and 4.0
  allows local users to affect confidentiality, integrity, and availability
  via unknown vectors.

CVE-2011-2300 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2300):
  Unspecified vulnerability in Oracle VM VirtualBox 4.0 allows local users to
  affect confidentiality, integrity, and availability via unknown vectors
  related to Guest Additions for Windows.

CVE-2010-4414 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-4414):
  Unspecified vulnerability in Oracle VM VirtualBox 4.0 allows local users to
  affect confidentiality, integrity, and availability via unknown vectors
  related to Extensions.

[Comment 1 Lars Wendler (Polynomial-C) (RETIRED) 2011-10-24 21:27:55 UTC]

4.1.4 version seems to be fine for stabilization.

[Comment 2 Tim Sammut (RETIRED) 2011-10-25 00:08:37 UTC]

(In reply to comment #1)
> 4.1.4 version seems to be fine for stabilization.

Thank you.

Arches, please test and mark stable:
=app-emulation/virtualbox-4.1.4
Target keywords : "amd64 x86"

=app-emulation/virtualbox-bin-4.1.4
Target keywords : "amd64 x86"

[Comment 3 Lars Wendler (Polynomial-C) (RETIRED) 2011-10-25 05:45:31 UTC]

Eww... we need a buch of more packages stable.

Arches please test and mark stable the following packages (they all need to be stabilized together).

For Gentoo host system:
app-emulation/virtualbox-modules-4.1.4
app-emulation/virtualbox-bin-4.1.4
app-emulation/virtualbox-4.1.4
app-emulation/virtualbox-additions-4.1.4
app-emulation/virtualbox-extpack-oracle-4.1.4

For Gentoo guest system (when Gentoo is a VM inside of virtualbox):
x11-drivers/xf86-video-virtualbox-4.1.4
app-emulation/virtualbox-guest-additions-4.1.4

Target keywords for all packages are:
amd64 x86


If you guys need a Gentoo-VM to test the packages contact me via email and I give you access to my stable amd64/x86 VMs via ssh (please provide a valid ssh public-key).

[Comment 4 Tomáš "tpruzina" Pružina (amd64 [ex]AT) 2011-10-26 16:58:54 UTC]

Amd64 : Ok (I've been testing it since it got merged to the Portage tree on mixed tree machine w/o problems).

[Comment 5 blain 'Doc' Anderson 2011-10-26 19:46:09 UTC]

amd64 OK i use virtualbox all the time for testing purposes

[Comment 6 blain 'Doc' Anderson 2011-10-29 13:21:51 UTC]

(In reply to comment #5)
> amd64 OK i use virtualbox all the time for testing purposes

i wish to remove my ok, after testing on my work machine which i setupo on the package stopped my vm's a couple days after installing the upgrade, and now i can't get it to work at all. it may be my configuration or use files but i will 

stand by amd64 fail
  

sorry about the noise

[Comment 7 blain 'Doc' Anderson 2011-10-29 18:06:49 UTC]

(In reply to comment #6)
> (In reply to comment #5)
> > amd64 OK i use virtualbox all the time for testing purposes
> 
> i wish to remove my ok, after testing on my work machine which i setupo on the
> package stopped my vm's a couple days after installing the upgrade, and now i
> can't get it to work at all. it may be my configuration or use files but i will 
> 
> stand by amd64 fail
> 
> 
> sorry about the noise

sorry again and for the reversal, compiles fine and runs, i had a system failure from running VM on a bad build. restarted and fine

amd64 ok

[Comment 8 Elijah "Armageddon" El Lazkani (amd64 AT) 2011-10-29 19:16:33 UTC]

amd64: pass

[Comment 9 Tony Vroon (RETIRED) 2011-11-01 11:05:20 UTC]

+  01 Nov 2011; Tony Vroon <[e-mail]>
+  virtualbox-modules-4.1.4.ebuild:
+  Marked stable on AMD64 based on arch testing by Tomáš "Mepho" Pružina,
+  Blain "doc235" Anderson & Elijah "Armageddon" El Lazkani in security bug
+  #386317.

+  01 Nov 2011; Tony Vroon <[e-mail]> virtualbox-bin-4.1.4.ebuild:
+  Marked stable on AMD64 based on arch testing by Tomáš "Mepho" Pružina,
+  Blain "doc235" Anderson & Elijah "Armageddon" El Lazkani in security bug
+  #386317.

+  01 Nov 2011; Tony Vroon <[e-mail]>
+  virtualbox-additions-4.1.4.ebuild:
+  Marked stable on AMD64 based on arch testing by Tomáš "Mepho" Pružina,
+  Blain "doc235" Anderson & Elijah "Armageddon" El Lazkani in security bug
+  #386317.

+  01 Nov 2011; Tony Vroon <[e-mail]>
+  virtualbox-extpack-oracle-4.1.4.ebuild:
+  Marked stable on AMD64 based on arch testing by Tomáš "Mepho" Pružina,
+  Blain "doc235" Anderson & Elijah "Armageddon" El Lazkani in security bug
+  #386317.

+  01 Nov 2011; Tony Vroon <[e-mail]>
+  kbuild-0.1.9998_pre20110817.ebuild:
+  Marked stable on AMD64 based on arch testing by Tomáš "Mepho" Pružina,
+  Blain "doc235" Anderson & Elijah "Armageddon" El Lazkani in security bug
+  #386317.

+  01 Nov 2011; Tony Vroon <[e-mail]> virtualbox-4.1.4.ebuild:
+  Marked stable on AMD64 based on arch testing by Tomáš "Mepho" Pružina,
+  Blain "doc235" Anderson & Elijah "Armageddon" El Lazkani in security bug
+  #386317.

+  01 Nov 2011; Tony Vroon <[e-mail]>
+  xf86-video-virtualbox-4.1.4.ebuild:
+  Marked stable on AMD64 based on arch testing by Tomáš "Mepho" Pružina,
+  Blain "doc235" Anderson & Elijah "Armageddon" El Lazkani in security bug
+  #386317.

+  01 Nov 2011; Tony Vroon <[e-mail]>
+  virtualbox-guest-additions-4.1.4-r1.ebuild:
+  Marked stable on AMD64 based on arch testing by Tomáš "Mepho" Pružina,
+  Blain "doc235" Anderson & Elijah "Armageddon" El Lazkani in security bug
+  #386317.

[Comment 10 Paweł Hajdan, Jr. (RETIRED) 2011-12-07 17:29:53 UTC]

x86 stable

[Comment 11 Sean Amoss (RETIRED) 2011-12-07 22:02:14 UTC]

Thanks, everyone. GLSA request filed.

[Comment 12 GLSAMaker/CVETool Bot 2012-04-09 22:54:47 UTC]

This issue was resolved and addressed in
 GLSA 201204-01 at http://security.gentoo.org/glsa/glsa-201204-01.xml
by GLSA coordinator Sean Amoss (ackle).