Security restrictions bypass in Oracle VM VirtualBox - CVE-2018-2845

Vulnerability identifier: #VU11902

CSH Severity: Low

CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

CVE-ID: CVE-2018-2845

CWE-ID: CWE-264

Exploitation vector: Local access

Exploit availability: No public exploit available

Vendor: Oracle

Affected software:
Oracle VM VirtualBox

The vulnerability allows a local attacker to obtain potentially sensitive information, write arbitrary files and cause DoS condition on the target system.

The weakness exists in the Oracle VM VirtualBox Core component due to improper information control. A local attacker can partially access data, partially modify data and cause the service to crash.

Update to versions 5.1.36 or 5.2.10.

• http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html