CVE-2021-35538
published 2021-10-20CVE-2021-35538: Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.28. Easily…
PriorityP339high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.40%
32.4th percentile
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.28. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. Note: This vulnerability does not apply to Windows systems. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | virtualbox | — | — |
| libjpeg-turbo | libjpeg-turbo | >= 0 < 1.5.2-0ubuntu5.18.04.6 | 1.5.2-0ubuntu5.18.04.6 |
| libjpeg-turbo | libjpeg-turbo | >= 0 < 2.0.3-0ubuntu1.20.04.3 | 2.0.3-0ubuntu1.20.04.3 |
| oracle | vm_virtualbox | < 6.1.28 | 6.1.28 |
| oracle_corporation | vm_virtualbox | >= unspecified < 6.1.28 | 6.1.28 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.04.6MEDIUMAV:L/AC:L/Au:N/C:P/I:P/A:P
osv7.8HIGH
vendor_debian7.8LOW
vendor_oracle7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
libjpeg-turbo vulnerabilities
osv·2022-09-22·CVSS 7.5
CVE-2018-11813 libjpeg-turbo vulnerabilities
libjpeg-turbo vulnerabilities
It was discovered that libjpeg-turbo incorrectly handled certain EOF
characters. An attacker could possibly use this issue to cause
libjpeg-turbo to consume resource, leading to a denial of service. This
issue only affected Ubuntu 18.04 LTS. (CVE-2018-11813)
It was discovered that libjpeg-turbo incorrectly handled certain malformed
jpeg files. An attacker could possibly use this issue to cause
libjpeg-turbo to crash, resulting in a denial of service. (CVE-2020-17541,
CVE-2020-35538)
It was discovered that libjpeg-turbo incorrectly handled certain malformed
PPM files. An attacker could use this issue to cause libjpeg-turbo to
crash, resulting in a denial of service, or possibly execute arbitrary
code. This issue only affected Ubuntu 20.04 LTS. (CVE-2021-4682
GHSA
GHSA-hfj7-x4jh-m6v4: Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)
ghsa_unreviewed·2022-05-24
CVE-2021-35538 [HIGH] GHSA-hfj7-x4jh-m6v4: Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.28. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. Note: This vulnerability does not apply to Windows systems. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
OSV
CVE-2021-35538: Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)
osv·2021-10-20·CVSS 7.8
CVE-2021-35538 [HIGH] CVE-2021-35538: Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.28. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. Note: This vulnerability does not apply to Windows systems. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Oracle
Oracle Oracle Virtualization Risk Matrix: Core — CVE-2021-35538
vendor_oracle·2021-10-15·CVSS 7.8
CVE-2021-35538 [HIGH] Oracle Oracle Virtualization Risk Matrix: Core — CVE-2021-35538
Oracle Oracle Virtualization Risk Matrix: Core vulnerability
CVE: CVE-2021-35538
CVSS: 7.8
Protocol: None
Remote exploit: No
Affected versions: Local
Advisory: cpuoct2021 (OCT 2021)
Debian
CVE-2021-35538: virtualbox - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (comp...
vendor_debian·2021·CVSS 7.8
CVE-2021-35538 [HIGH] CVE-2021-35538: virtualbox - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (comp...
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.28. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. Note: This vulnerability does not apply to Windows systems. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Scope: local
sid: resolved
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2021-10-20
Published