#VU11902 Security restrictions bypass in Oracle VM VirtualBox - CVE-2018-2845

Vulnerability identifier: #VU11902

Vulnerability risk: Low

CVSSv4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

CVE-ID: CVE-2018-2845

CWE-ID: CWE-264

Exploitation vector: Local access

Exploit availability: No public exploit available

Vulnerable software:
Oracle VM VirtualBox

Software vendor:
Oracle

The vulnerability allows a local attacker to obtain potentially sensitive information, write arbitrary files and cause DoS condition on the target system.

The weakness exists in the Oracle VM VirtualBox Core component due to improper information control. A local attacker can partially access data, partially modify data and cause the service to crash.

Update to versions 5.1.36 or 5.2.10.

• http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html