From secunia at $URL: Description halfdog has reported a vulnerability in Oracle VirtualBox, which can be exploited by malicious, local users in a guest virtual machine to cause a DoS (Denial of Service). The vulnerability is caused due to a NULL-pointer dereference error when calling the task-gate via IDT (software interrupt) with insufficient privileges in a processor missing VT-x / AMD-V extensions and can be exploited to cause a crash. The vulnerability is reported in versions prior to 4.1.22. Solution Update to version 4.1.22.
Arches please test and mark stable the following packages: =app-emulation/virtualbox-4.1.22 =app-emulation/virtualbox-additions-4.1.22 =app-emulation/virtualbox-bin-4.1.22 =app-emulation/virtualbox-extpack-oracle-4.1.22 =app-emulation/virtualbox-guest-additions-4.1.22 =app-emulation/virtualbox-modules-4.1.22 =x11-drivers/xf86-video-virtualbox-4.1.22 Target keywords are: amd64 x86 Although only app-emulation/virtualbox{,-bin} are affected we need all these packages stable as they are: - a dependency of app-emulation/virtualbox{,-bin} - need to stay in sync with the rest of the packages
I'm not sure if all need to be kept in sync. For amd64 I've tested and can stabilize: =app-emulation/virtualbox-bin-4.1.22 =app-emulation/virtualbox-guest-additions-4.1.22 =app-emulation/virtualbox-modules-4.1.22
(In reply to comment #1) > =app-emulation/virtualbox-4.1.22 > =app-emulation/virtualbox-additions-4.1.22 > =app-emulation/virtualbox-bin-4.1.22 > =app-emulation/virtualbox-extpack-oracle-4.1.22 > =app-emulation/virtualbox-guest-additions-4.1.22 > =app-emulation/virtualbox-modules-4.1.22 > =x11-drivers/xf86-video-virtualbox-4.1.22 amd64 ok
amd64 stable, thanks Maurizio and Richard
x86 done. thanks! last arch!
security, please vote
GLSA vote: yes.
GLSA Vote: yes, too. Request filed.
CVE-2012-3221 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-3221): Unspecified vulnerability in the Oracle VM Virtual Box component in Oracle Virtualization 3.2, 4.0, and 4.1 allows local users to affect availability via unknown vectors related to VirtualBox Core.
This issue was resolved and addressed in GLSA 201401-13 at http://security.gentoo.org/glsa/glsa-201401-13.xml by GLSA coordinator Sergey Popov (pinkbyte).