CVE-2014-0981

Publication date 31 March 2014

Last updated 24 July 2024


Ubuntu priority

VBox/GuestHost/OpenGL/util/net.c in Oracle VirtualBox before 3.2.22, 4.0.x before 4.0.24, 4.1.x before 4.1.32, 4.2.x before 4.2.24, and 4.3.x before 4.3.8, when using 3D Acceleration allows local guest OS users to execute arbitrary code on the Chromium server via crafted Chromium network pointer in a (1) CR_MESSAGE_READBACK or (2) CR_MESSAGE_WRITEBACK message to the VBoxSharedCrOpenGL service, which triggers an arbitrary pointer dereference and memory corruption. NOTE: this issue was MERGED with CVE-2014-0982 because it is the same type of vulnerability affecting the same set of versions. All CVE users should reference CVE-2014-0981 instead of CVE-2014-0982.

Status

Package Ubuntu Release Status
virtualbox 14.04 LTS trusty Not in release
13.10 saucy
Fixed 4.2.16-dfsg-3ubuntu0.1
12.10 quantal Ignored end of life
12.04 LTS precise
Fixed 4.1.12-dfsg-2ubuntu0.6
10.04 LTS lucid Not in release
virtualbox-ose 14.04 LTS trusty Not in release
13.10 saucy Not in release
12.10 quantal Not in release
12.04 LTS precise Not in release
10.04 LTS lucid Ignored end of life

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
virtualbox