csaf_opensuse - opensuse-su-2020:1511-1

Vulnerability from csaf_opensuse

Published

2020-09-23 22:20

Modified

2020-09-23 22:20

Summary

Security update for virtualbox

Notes

Title of the patch

Security update for virtualbox

Description of the patch

This update for virtualbox fixes the following issues: Version Bump to 6.0.24 (released July 14 2020 by Oracle) This is a maintenance release. The following items were fixed and/or added: - API: Fix unintentionally enabled audio due to a settings file version dependent bug - VBoxManage: Fix crash of 'VBoxManage internalcommands repairhd' when processing invalid input (bug #19579) - Guest Additions: Fix issues detecting guest additions ISO at runtime - Fixes CVE-2020-14628, CVE-2020-14646, CVE-2020-14647, CVE-2020-14649, CVE-2020-14713, CVE-2020-14674, CVE-2020-14675, CVE-2020-14676, CVE-2020-14677, CVE-2020-14699, CVE-2020-14711, CVE-2020-14629, CVE-2020-14703, CVE-2020-14704, CVE-2020-14648, CVE-2020-14650, CVE-2020-14673, CVE-2020-14694, CVE-2020-14695, CVE-2020-14698, CVE-2020-14700, CVE-2020-14712, CVE-2020-14707, CVE-2020-14714, CVE-2020-14715 boo#1174159

Patchnames

openSUSE-2020-1511

CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).

JSON

To clipboard

{
   document: {
      aggregate_severity: {
         namespace: "https://www.suse.com/support/security/rating/",
         text: "important",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright 2024 SUSE LLC. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "Security update for virtualbox",
            title: "Title of the patch",
         },
         {
            category: "description",
            text: "This update for virtualbox fixes the following issues:\n\nVersion Bump to 6.0.24 (released July 14 2020 by Oracle)\n\nThis is a maintenance release. The following items were fixed and/or added:\n\n- API: Fix unintentionally enabled audio due to a settings file version dependent bug\n- VBoxManage: Fix crash of 'VBoxManage internalcommands repairhd' when processing invalid input (bug #19579)\n- Guest Additions: Fix issues detecting guest additions ISO at runtime\n- Fixes CVE-2020-14628,\tCVE-2020-14646, CVE-2020-14647, CVE-2020-14649,\tCVE-2020-14713, CVE-2020-14674,\n\tCVE-2020-14675, CVE-2020-14676, CVE-2020-14677, CVE-2020-14699, CVE-2020-14711, CVE-2020-14629, \t \n\tCVE-2020-14703, CVE-2020-14704, CVE-2020-14648, CVE-2020-14650, CVE-2020-14673, CVE-2020-14694, \t \n\tCVE-2020-14695, CVE-2020-14698, CVE-2020-14700, CVE-2020-14712, CVE-2020-14707, CVE-2020-14714,\n\tCVE-2020-14715 boo#1174159\n",
            title: "Description of the patch",
         },
         {
            category: "details",
            text: "openSUSE-2020-1511",
            title: "Patchnames",
         },
         {
            category: "legal_disclaimer",
            text: "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
            title: "Terms of use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://www.suse.com/support/security/contact/",
         name: "SUSE Product Security Team",
         namespace: "https://www.suse.com/",
      },
      references: [
         {
            category: "external",
            summary: "SUSE ratings",
            url: "https://www.suse.com/support/security/rating/",
         },
         {
            category: "self",
            summary: "URL of this CSAF notice",
            url: "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2020_1511-1.json",
         },
         {
            category: "self",
            summary: "URL for openSUSE-SU-2020:1511-1",
            url: "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/KM2XQAPU3TQDQZ4WW6RTJFFDA3PDGTQQ/",
         },
         {
            category: "self",
            summary: "E-Mail link for openSUSE-SU-2020:1511-1",
            url: "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/KM2XQAPU3TQDQZ4WW6RTJFFDA3PDGTQQ/",
         },
         {
            category: "self",
            summary: "SUSE Bug 1174159",
            url: "https://bugzilla.suse.com/1174159",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2020-14628 page",
            url: "https://www.suse.com/security/cve/CVE-2020-14628/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2020-14629 page",
            url: "https://www.suse.com/security/cve/CVE-2020-14629/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2020-14646 page",
            url: "https://www.suse.com/security/cve/CVE-2020-14646/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2020-14647 page",
            url: "https://www.suse.com/security/cve/CVE-2020-14647/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2020-14648 page",
            url: "https://www.suse.com/security/cve/CVE-2020-14648/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2020-14649 page",
            url: "https://www.suse.com/security/cve/CVE-2020-14649/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2020-14650 page",
            url: "https://www.suse.com/security/cve/CVE-2020-14650/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2020-14673 page",
            url: "https://www.suse.com/security/cve/CVE-2020-14673/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2020-14674 page",
            url: "https://www.suse.com/security/cve/CVE-2020-14674/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2020-14675 page",
            url: "https://www.suse.com/security/cve/CVE-2020-14675/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2020-14676 page",
            url: "https://www.suse.com/security/cve/CVE-2020-14676/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2020-14677 page",
            url: "https://www.suse.com/security/cve/CVE-2020-14677/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2020-14694 page",
            url: "https://www.suse.com/security/cve/CVE-2020-14694/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2020-14695 page",
            url: "https://www.suse.com/security/cve/CVE-2020-14695/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2020-14698 page",
            url: "https://www.suse.com/security/cve/CVE-2020-14698/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2020-14699 page",
            url: "https://www.suse.com/security/cve/CVE-2020-14699/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2020-14700 page",
            url: "https://www.suse.com/security/cve/CVE-2020-14700/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2020-14703 page",
            url: "https://www.suse.com/security/cve/CVE-2020-14703/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2020-14704 page",
            url: "https://www.suse.com/security/cve/CVE-2020-14704/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2020-14707 page",
            url: "https://www.suse.com/security/cve/CVE-2020-14707/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2020-14711 page",
            url: "https://www.suse.com/security/cve/CVE-2020-14711/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2020-14712 page",
            url: "https://www.suse.com/security/cve/CVE-2020-14712/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2020-14713 page",
            url: "https://www.suse.com/security/cve/CVE-2020-14713/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2020-14714 page",
            url: "https://www.suse.com/security/cve/CVE-2020-14714/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2020-14715 page",
            url: "https://www.suse.com/security/cve/CVE-2020-14715/",
         },
      ],
      title: "Security update for virtualbox",
      tracking: {
         current_release_date: "2020-09-23T22:20:49Z",
         generator: {
            date: "2020-09-23T22:20:49Z",
            engine: {
               name: "cve-database.git:bin/generate-csaf.pl",
               version: "1",
            },
         },
         id: "openSUSE-SU-2020:1511-1",
         initial_release_date: "2020-09-23T22:20:49Z",
         revision_history: [
            {
               date: "2020-09-23T22:20:49Z",
               number: "1",
               summary: "Current version",
            },
         ],
         status: "final",
         version: "1",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "virtualbox-guest-desktop-icons-6.0.24-lp151.2.18.1.noarch",
                        product: {
                           name: "virtualbox-guest-desktop-icons-6.0.24-lp151.2.18.1.noarch",
                           product_id: "virtualbox-guest-desktop-icons-6.0.24-lp151.2.18.1.noarch",
                        },
                     },
                     {
                        category: "product_version",
                        name: "virtualbox-guest-source-6.0.24-lp151.2.18.1.noarch",
                        product: {
                           name: "virtualbox-guest-source-6.0.24-lp151.2.18.1.noarch",
                           product_id: "virtualbox-guest-source-6.0.24-lp151.2.18.1.noarch",
                        },
                     },
                     {
                        category: "product_version",
                        name: "virtualbox-host-source-6.0.24-lp151.2.18.1.noarch",
                        product: {
                           name: "virtualbox-host-source-6.0.24-lp151.2.18.1.noarch",
                           product_id: "virtualbox-host-source-6.0.24-lp151.2.18.1.noarch",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "noarch",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "python3-virtualbox-6.0.24-lp151.2.18.1.x86_64",
                        product: {
                           name: "python3-virtualbox-6.0.24-lp151.2.18.1.x86_64",
                           product_id: "python3-virtualbox-6.0.24-lp151.2.18.1.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "virtualbox-6.0.24-lp151.2.18.1.x86_64",
                        product: {
                           name: "virtualbox-6.0.24-lp151.2.18.1.x86_64",
                           product_id: "virtualbox-6.0.24-lp151.2.18.1.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "virtualbox-devel-6.0.24-lp151.2.18.1.x86_64",
                        product: {
                           name: "virtualbox-devel-6.0.24-lp151.2.18.1.x86_64",
                           product_id: "virtualbox-devel-6.0.24-lp151.2.18.1.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "virtualbox-guest-tools-6.0.24-lp151.2.18.1.x86_64",
                        product: {
                           name: "virtualbox-guest-tools-6.0.24-lp151.2.18.1.x86_64",
                           product_id: "virtualbox-guest-tools-6.0.24-lp151.2.18.1.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "virtualbox-guest-x11-6.0.24-lp151.2.18.1.x86_64",
                        product: {
                           name: "virtualbox-guest-x11-6.0.24-lp151.2.18.1.x86_64",
                           product_id: "virtualbox-guest-x11-6.0.24-lp151.2.18.1.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "virtualbox-kmp-default-6.0.24_k4.12.14_lp151.28.67-lp151.2.18.1.x86_64",
                        product: {
                           name: "virtualbox-kmp-default-6.0.24_k4.12.14_lp151.28.67-lp151.2.18.1.x86_64",
                           product_id: "virtualbox-kmp-default-6.0.24_k4.12.14_lp151.28.67-lp151.2.18.1.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "virtualbox-qt-6.0.24-lp151.2.18.1.x86_64",
                        product: {
                           name: "virtualbox-qt-6.0.24-lp151.2.18.1.x86_64",
                           product_id: "virtualbox-qt-6.0.24-lp151.2.18.1.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "virtualbox-vnc-6.0.24-lp151.2.18.1.x86_64",
                        product: {
                           name: "virtualbox-vnc-6.0.24-lp151.2.18.1.x86_64",
                           product_id: "virtualbox-vnc-6.0.24-lp151.2.18.1.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "virtualbox-websrv-6.0.24-lp151.2.18.1.x86_64",
                        product: {
                           name: "virtualbox-websrv-6.0.24-lp151.2.18.1.x86_64",
                           product_id: "virtualbox-websrv-6.0.24-lp151.2.18.1.x86_64",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "x86_64",
               },
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "openSUSE Leap 15.1",
                        product: {
                           name: "openSUSE Leap 15.1",
                           product_id: "openSUSE Leap 15.1",
                           product_identification_helper: {
                              cpe: "cpe:/o:opensuse:leap:15.1",
                           },
                        },
                     },
                  ],
                  category: "product_family",
                  name: "SUSE Linux Enterprise",
               },
            ],
            category: "vendor",
            name: "SUSE",
         },
      ],
      relationships: [
         {
            category: "default_component_of",
            full_product_name: {
               name: "python3-virtualbox-6.0.24-lp151.2.18.1.x86_64 as component of openSUSE Leap 15.1",
               product_id: "openSUSE Leap 15.1:python3-virtualbox-6.0.24-lp151.2.18.1.x86_64",
            },
            product_reference: "python3-virtualbox-6.0.24-lp151.2.18.1.x86_64",
            relates_to_product_reference: "openSUSE Leap 15.1",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "virtualbox-6.0.24-lp151.2.18.1.x86_64 as component of openSUSE Leap 15.1",
               product_id: "openSUSE Leap 15.1:virtualbox-6.0.24-lp151.2.18.1.x86_64",
            },
            product_reference: "virtualbox-6.0.24-lp151.2.18.1.x86_64",
            relates_to_product_reference: "openSUSE Leap 15.1",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "virtualbox-devel-6.0.24-lp151.2.18.1.x86_64 as component of openSUSE Leap 15.1",
               product_id: "openSUSE Leap 15.1:virtualbox-devel-6.0.24-lp151.2.18.1.x86_64",
            },
            product_reference: "virtualbox-devel-6.0.24-lp151.2.18.1.x86_64",
            relates_to_product_reference: "openSUSE Leap 15.1",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "virtualbox-guest-desktop-icons-6.0.24-lp151.2.18.1.noarch as component of openSUSE Leap 15.1",
               product_id: "openSUSE Leap 15.1:virtualbox-guest-desktop-icons-6.0.24-lp151.2.18.1.noarch",
            },
            product_reference: "virtualbox-guest-desktop-icons-6.0.24-lp151.2.18.1.noarch",
            relates_to_product_reference: "openSUSE Leap 15.1",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "virtualbox-guest-source-6.0.24-lp151.2.18.1.noarch as component of openSUSE Leap 15.1",
               product_id: "openSUSE Leap 15.1:virtualbox-guest-source-6.0.24-lp151.2.18.1.noarch",
            },
            product_reference: "virtualbox-guest-source-6.0.24-lp151.2.18.1.noarch",
            relates_to_product_reference: "openSUSE Leap 15.1",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "virtualbox-guest-tools-6.0.24-lp151.2.18.1.x86_64 as component of openSUSE Leap 15.1",
               product_id: "openSUSE Leap 15.1:virtualbox-guest-tools-6.0.24-lp151.2.18.1.x86_64",
            },
            product_reference: "virtualbox-guest-tools-6.0.24-lp151.2.18.1.x86_64",
            relates_to_product_reference: "openSUSE Leap 15.1",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "virtualbox-guest-x11-6.0.24-lp151.2.18.1.x86_64 as component of openSUSE Leap 15.1",
               product_id: "openSUSE Leap 15.1:virtualbox-guest-x11-6.0.24-lp151.2.18.1.x86_64",
            },
            product_reference: "virtualbox-guest-x11-6.0.24-lp151.2.18.1.x86_64",
            relates_to_product_reference: "openSUSE Leap 15.1",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "virtualbox-host-source-6.0.24-lp151.2.18.1.noarch as component of openSUSE Leap 15.1",
               product_id: "openSUSE Leap 15.1:virtualbox-host-source-6.0.24-lp151.2.18.1.noarch",
            },
            product_reference: "virtualbox-host-source-6.0.24-lp151.2.18.1.noarch",
            relates_to_product_reference: "openSUSE Leap 15.1",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "virtualbox-kmp-default-6.0.24_k4.12.14_lp151.28.67-lp151.2.18.1.x86_64 as component of openSUSE Leap 15.1",
               product_id: "openSUSE Leap 15.1:virtualbox-kmp-default-6.0.24_k4.12.14_lp151.28.67-lp151.2.18.1.x86_64",
            },
            product_reference: "virtualbox-kmp-default-6.0.24_k4.12.14_lp151.28.67-lp151.2.18.1.x86_64",
            relates_to_product_reference: "openSUSE Leap 15.1",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "virtualbox-qt-6.0.24-lp151.2.18.1.x86_64 as component of openSUSE Leap 15.1",
               product_id: "openSUSE Leap 15.1:virtualbox-qt-6.0.24-lp151.2.18.1.x86_64",
            },
            product_reference: "virtualbox-qt-6.0.24-lp151.2.18.1.x86_64",
            relates_to_product_reference: "openSUSE Leap 15.1",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "virtualbox-vnc-6.0.24-lp151.2.18.1.x86_64 as component of openSUSE Leap 15.1",
               product_id: "openSUSE Leap 15.1:virtualbox-vnc-6.0.24-lp151.2.18.1.x86_64",
            },
            product_reference: "virtualbox-vnc-6.0.24-lp151.2.18.1.x86_64",
            relates_to_product_reference: "openSUSE Leap 15.1",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "virtualbox-websrv-6.0.24-lp151.2.18.1.x86_64 as component of openSUSE Leap 15.1",
               product_id: "openSUSE Leap 15.1:virtualbox-websrv-6.0.24-lp151.2.18.1.x86_64",
            },
            product_reference: "virtualbox-websrv-6.0.24-lp151.2.18.1.x86_64",
            relates_to_product_reference: "openSUSE Leap 15.1",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2020-14628",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2020-14628",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. Note: The CVE-2020-14628 is applicable to Windows VM only. CVSS 3.1 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Leap 15.1:python3-virtualbox-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-devel-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-guest-desktop-icons-6.0.24-lp151.2.18.1.noarch",
               "openSUSE Leap 15.1:virtualbox-guest-source-6.0.24-lp151.2.18.1.noarch",
               "openSUSE Leap 15.1:virtualbox-guest-tools-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-guest-x11-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-host-source-6.0.24-lp151.2.18.1.noarch",
               "openSUSE Leap 15.1:virtualbox-kmp-default-6.0.24_k4.12.14_lp151.28.67-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-qt-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-vnc-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-websrv-6.0.24-lp151.2.18.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2020-14628",
               url: "https://www.suse.com/security/cve/CVE-2020-14628",
            },
            {
               category: "external",
               summary: "SUSE Bug 1174159 for CVE-2020-14628",
               url: "https://bugzilla.suse.com/1174159",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Leap 15.1:python3-virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-devel-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-desktop-icons-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-tools-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-x11-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-host-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-kmp-default-6.0.24_k4.12.14_lp151.28.67-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-qt-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-vnc-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-websrv-6.0.24-lp151.2.18.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 8.2,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "openSUSE Leap 15.1:python3-virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-devel-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-desktop-icons-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-tools-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-x11-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-host-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-kmp-default-6.0.24_k4.12.14_lp151.28.67-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-qt-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-vnc-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-websrv-6.0.24-lp151.2.18.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2020-09-23T22:20:49Z",
               details: "important",
            },
         ],
         title: "CVE-2020-14628",
      },
      {
         cve: "CVE-2020-14629",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2020-14629",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 6.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N).",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Leap 15.1:python3-virtualbox-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-devel-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-guest-desktop-icons-6.0.24-lp151.2.18.1.noarch",
               "openSUSE Leap 15.1:virtualbox-guest-source-6.0.24-lp151.2.18.1.noarch",
               "openSUSE Leap 15.1:virtualbox-guest-tools-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-guest-x11-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-host-source-6.0.24-lp151.2.18.1.noarch",
               "openSUSE Leap 15.1:virtualbox-kmp-default-6.0.24_k4.12.14_lp151.28.67-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-qt-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-vnc-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-websrv-6.0.24-lp151.2.18.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2020-14629",
               url: "https://www.suse.com/security/cve/CVE-2020-14629",
            },
            {
               category: "external",
               summary: "SUSE Bug 1174159 for CVE-2020-14629",
               url: "https://bugzilla.suse.com/1174159",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Leap 15.1:python3-virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-devel-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-desktop-icons-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-tools-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-x11-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-host-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-kmp-default-6.0.24_k4.12.14_lp151.28.67-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-qt-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-vnc-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-websrv-6.0.24-lp151.2.18.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 6,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
                  version: "3.1",
               },
               products: [
                  "openSUSE Leap 15.1:python3-virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-devel-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-desktop-icons-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-tools-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-x11-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-host-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-kmp-default-6.0.24_k4.12.14_lp151.28.67-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-qt-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-vnc-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-websrv-6.0.24-lp151.2.18.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2020-09-23T22:20:49Z",
               details: "moderate",
            },
         ],
         title: "CVE-2020-14629",
      },
      {
         cve: "CVE-2020-14646",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2020-14646",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Leap 15.1:python3-virtualbox-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-devel-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-guest-desktop-icons-6.0.24-lp151.2.18.1.noarch",
               "openSUSE Leap 15.1:virtualbox-guest-source-6.0.24-lp151.2.18.1.noarch",
               "openSUSE Leap 15.1:virtualbox-guest-tools-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-guest-x11-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-host-source-6.0.24-lp151.2.18.1.noarch",
               "openSUSE Leap 15.1:virtualbox-kmp-default-6.0.24_k4.12.14_lp151.28.67-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-qt-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-vnc-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-websrv-6.0.24-lp151.2.18.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2020-14646",
               url: "https://www.suse.com/security/cve/CVE-2020-14646",
            },
            {
               category: "external",
               summary: "SUSE Bug 1174159 for CVE-2020-14646",
               url: "https://bugzilla.suse.com/1174159",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Leap 15.1:python3-virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-devel-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-desktop-icons-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-tools-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-x11-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-host-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-kmp-default-6.0.24_k4.12.14_lp151.28.67-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-qt-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-vnc-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-websrv-6.0.24-lp151.2.18.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "openSUSE Leap 15.1:python3-virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-devel-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-desktop-icons-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-tools-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-x11-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-host-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-kmp-default-6.0.24_k4.12.14_lp151.28.67-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-qt-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-vnc-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-websrv-6.0.24-lp151.2.18.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2020-09-23T22:20:49Z",
               details: "important",
            },
         ],
         title: "CVE-2020-14646",
      },
      {
         cve: "CVE-2020-14647",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2020-14647",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Leap 15.1:python3-virtualbox-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-devel-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-guest-desktop-icons-6.0.24-lp151.2.18.1.noarch",
               "openSUSE Leap 15.1:virtualbox-guest-source-6.0.24-lp151.2.18.1.noarch",
               "openSUSE Leap 15.1:virtualbox-guest-tools-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-guest-x11-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-host-source-6.0.24-lp151.2.18.1.noarch",
               "openSUSE Leap 15.1:virtualbox-kmp-default-6.0.24_k4.12.14_lp151.28.67-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-qt-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-vnc-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-websrv-6.0.24-lp151.2.18.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2020-14647",
               url: "https://www.suse.com/security/cve/CVE-2020-14647",
            },
            {
               category: "external",
               summary: "SUSE Bug 1174159 for CVE-2020-14647",
               url: "https://bugzilla.suse.com/1174159",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Leap 15.1:python3-virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-devel-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-desktop-icons-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-tools-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-x11-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-host-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-kmp-default-6.0.24_k4.12.14_lp151.28.67-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-qt-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-vnc-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-websrv-6.0.24-lp151.2.18.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "openSUSE Leap 15.1:python3-virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-devel-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-desktop-icons-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-tools-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-x11-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-host-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-kmp-default-6.0.24_k4.12.14_lp151.28.67-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-qt-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-vnc-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-websrv-6.0.24-lp151.2.18.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2020-09-23T22:20:49Z",
               details: "important",
            },
         ],
         title: "CVE-2020-14647",
      },
      {
         cve: "CVE-2020-14648",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2020-14648",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N).",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Leap 15.1:python3-virtualbox-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-devel-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-guest-desktop-icons-6.0.24-lp151.2.18.1.noarch",
               "openSUSE Leap 15.1:virtualbox-guest-source-6.0.24-lp151.2.18.1.noarch",
               "openSUSE Leap 15.1:virtualbox-guest-tools-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-guest-x11-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-host-source-6.0.24-lp151.2.18.1.noarch",
               "openSUSE Leap 15.1:virtualbox-kmp-default-6.0.24_k4.12.14_lp151.28.67-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-qt-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-vnc-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-websrv-6.0.24-lp151.2.18.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2020-14648",
               url: "https://www.suse.com/security/cve/CVE-2020-14648",
            },
            {
               category: "external",
               summary: "SUSE Bug 1174159 for CVE-2020-14648",
               url: "https://bugzilla.suse.com/1174159",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Leap 15.1:python3-virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-devel-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-desktop-icons-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-tools-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-x11-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-host-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-kmp-default-6.0.24_k4.12.14_lp151.28.67-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-qt-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-vnc-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-websrv-6.0.24-lp151.2.18.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N",
                  version: "3.1",
               },
               products: [
                  "openSUSE Leap 15.1:python3-virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-devel-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-desktop-icons-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-tools-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-x11-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-host-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-kmp-default-6.0.24_k4.12.14_lp151.28.67-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-qt-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-vnc-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-websrv-6.0.24-lp151.2.18.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2020-09-23T22:20:49Z",
               details: "moderate",
            },
         ],
         title: "CVE-2020-14648",
      },
      {
         cve: "CVE-2020-14649",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2020-14649",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Leap 15.1:python3-virtualbox-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-devel-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-guest-desktop-icons-6.0.24-lp151.2.18.1.noarch",
               "openSUSE Leap 15.1:virtualbox-guest-source-6.0.24-lp151.2.18.1.noarch",
               "openSUSE Leap 15.1:virtualbox-guest-tools-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-guest-x11-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-host-source-6.0.24-lp151.2.18.1.noarch",
               "openSUSE Leap 15.1:virtualbox-kmp-default-6.0.24_k4.12.14_lp151.28.67-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-qt-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-vnc-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-websrv-6.0.24-lp151.2.18.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2020-14649",
               url: "https://www.suse.com/security/cve/CVE-2020-14649",
            },
            {
               category: "external",
               summary: "SUSE Bug 1174159 for CVE-2020-14649",
               url: "https://bugzilla.suse.com/1174159",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Leap 15.1:python3-virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-devel-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-desktop-icons-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-tools-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-x11-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-host-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-kmp-default-6.0.24_k4.12.14_lp151.28.67-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-qt-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-vnc-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-websrv-6.0.24-lp151.2.18.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "openSUSE Leap 15.1:python3-virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-devel-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-desktop-icons-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-tools-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-x11-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-host-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-kmp-default-6.0.24_k4.12.14_lp151.28.67-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-qt-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-vnc-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-websrv-6.0.24-lp151.2.18.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2020-09-23T22:20:49Z",
               details: "important",
            },
         ],
         title: "CVE-2020-14649",
      },
      {
         cve: "CVE-2020-14650",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2020-14650",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N).",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Leap 15.1:python3-virtualbox-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-devel-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-guest-desktop-icons-6.0.24-lp151.2.18.1.noarch",
               "openSUSE Leap 15.1:virtualbox-guest-source-6.0.24-lp151.2.18.1.noarch",
               "openSUSE Leap 15.1:virtualbox-guest-tools-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-guest-x11-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-host-source-6.0.24-lp151.2.18.1.noarch",
               "openSUSE Leap 15.1:virtualbox-kmp-default-6.0.24_k4.12.14_lp151.28.67-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-qt-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-vnc-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-websrv-6.0.24-lp151.2.18.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2020-14650",
               url: "https://www.suse.com/security/cve/CVE-2020-14650",
            },
            {
               category: "external",
               summary: "SUSE Bug 1174159 for CVE-2020-14650",
               url: "https://bugzilla.suse.com/1174159",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Leap 15.1:python3-virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-devel-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-desktop-icons-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-tools-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-x11-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-host-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-kmp-default-6.0.24_k4.12.14_lp151.28.67-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-qt-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-vnc-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-websrv-6.0.24-lp151.2.18.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N",
                  version: "3.1",
               },
               products: [
                  "openSUSE Leap 15.1:python3-virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-devel-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-desktop-icons-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-tools-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-x11-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-host-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-kmp-default-6.0.24_k4.12.14_lp151.28.67-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-qt-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-vnc-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-websrv-6.0.24-lp151.2.18.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2020-09-23T22:20:49Z",
               details: "moderate",
            },
         ],
         title: "CVE-2020-14650",
      },
      {
         cve: "CVE-2020-14673",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2020-14673",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N).",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Leap 15.1:python3-virtualbox-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-devel-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-guest-desktop-icons-6.0.24-lp151.2.18.1.noarch",
               "openSUSE Leap 15.1:virtualbox-guest-source-6.0.24-lp151.2.18.1.noarch",
               "openSUSE Leap 15.1:virtualbox-guest-tools-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-guest-x11-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-host-source-6.0.24-lp151.2.18.1.noarch",
               "openSUSE Leap 15.1:virtualbox-kmp-default-6.0.24_k4.12.14_lp151.28.67-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-qt-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-vnc-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-websrv-6.0.24-lp151.2.18.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2020-14673",
               url: "https://www.suse.com/security/cve/CVE-2020-14673",
            },
            {
               category: "external",
               summary: "SUSE Bug 1174159 for CVE-2020-14673",
               url: "https://bugzilla.suse.com/1174159",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Leap 15.1:python3-virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-devel-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-desktop-icons-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-tools-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-x11-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-host-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-kmp-default-6.0.24_k4.12.14_lp151.28.67-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-qt-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-vnc-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-websrv-6.0.24-lp151.2.18.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N",
                  version: "3.1",
               },
               products: [
                  "openSUSE Leap 15.1:python3-virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-devel-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-desktop-icons-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-tools-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-x11-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-host-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-kmp-default-6.0.24_k4.12.14_lp151.28.67-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-qt-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-vnc-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-websrv-6.0.24-lp151.2.18.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2020-09-23T22:20:49Z",
               details: "moderate",
            },
         ],
         title: "CVE-2020-14673",
      },
      {
         cve: "CVE-2020-14674",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2020-14674",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Leap 15.1:python3-virtualbox-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-devel-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-guest-desktop-icons-6.0.24-lp151.2.18.1.noarch",
               "openSUSE Leap 15.1:virtualbox-guest-source-6.0.24-lp151.2.18.1.noarch",
               "openSUSE Leap 15.1:virtualbox-guest-tools-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-guest-x11-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-host-source-6.0.24-lp151.2.18.1.noarch",
               "openSUSE Leap 15.1:virtualbox-kmp-default-6.0.24_k4.12.14_lp151.28.67-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-qt-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-vnc-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-websrv-6.0.24-lp151.2.18.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2020-14674",
               url: "https://www.suse.com/security/cve/CVE-2020-14674",
            },
            {
               category: "external",
               summary: "SUSE Bug 1174159 for CVE-2020-14674",
               url: "https://bugzilla.suse.com/1174159",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Leap 15.1:python3-virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-devel-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-desktop-icons-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-tools-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-x11-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-host-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-kmp-default-6.0.24_k4.12.14_lp151.28.67-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-qt-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-vnc-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-websrv-6.0.24-lp151.2.18.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "openSUSE Leap 15.1:python3-virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-devel-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-desktop-icons-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-tools-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-x11-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-host-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-kmp-default-6.0.24_k4.12.14_lp151.28.67-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-qt-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-vnc-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-websrv-6.0.24-lp151.2.18.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2020-09-23T22:20:49Z",
               details: "important",
            },
         ],
         title: "CVE-2020-14674",
      },
      {
         cve: "CVE-2020-14675",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2020-14675",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Leap 15.1:python3-virtualbox-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-devel-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-guest-desktop-icons-6.0.24-lp151.2.18.1.noarch",
               "openSUSE Leap 15.1:virtualbox-guest-source-6.0.24-lp151.2.18.1.noarch",
               "openSUSE Leap 15.1:virtualbox-guest-tools-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-guest-x11-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-host-source-6.0.24-lp151.2.18.1.noarch",
               "openSUSE Leap 15.1:virtualbox-kmp-default-6.0.24_k4.12.14_lp151.28.67-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-qt-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-vnc-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-websrv-6.0.24-lp151.2.18.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2020-14675",
               url: "https://www.suse.com/security/cve/CVE-2020-14675",
            },
            {
               category: "external",
               summary: "SUSE Bug 1174159 for CVE-2020-14675",
               url: "https://bugzilla.suse.com/1174159",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Leap 15.1:python3-virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-devel-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-desktop-icons-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-tools-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-x11-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-host-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-kmp-default-6.0.24_k4.12.14_lp151.28.67-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-qt-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-vnc-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-websrv-6.0.24-lp151.2.18.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "openSUSE Leap 15.1:python3-virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-devel-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-desktop-icons-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-tools-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-x11-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-host-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-kmp-default-6.0.24_k4.12.14_lp151.28.67-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-qt-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-vnc-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-websrv-6.0.24-lp151.2.18.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2020-09-23T22:20:49Z",
               details: "important",
            },
         ],
         title: "CVE-2020-14675",
      },
      {
         cve: "CVE-2020-14676",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2020-14676",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Leap 15.1:python3-virtualbox-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-devel-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-guest-desktop-icons-6.0.24-lp151.2.18.1.noarch",
               "openSUSE Leap 15.1:virtualbox-guest-source-6.0.24-lp151.2.18.1.noarch",
               "openSUSE Leap 15.1:virtualbox-guest-tools-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-guest-x11-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-host-source-6.0.24-lp151.2.18.1.noarch",
               "openSUSE Leap 15.1:virtualbox-kmp-default-6.0.24_k4.12.14_lp151.28.67-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-qt-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-vnc-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-websrv-6.0.24-lp151.2.18.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2020-14676",
               url: "https://www.suse.com/security/cve/CVE-2020-14676",
            },
            {
               category: "external",
               summary: "SUSE Bug 1174159 for CVE-2020-14676",
               url: "https://bugzilla.suse.com/1174159",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Leap 15.1:python3-virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-devel-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-desktop-icons-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-tools-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-x11-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-host-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-kmp-default-6.0.24_k4.12.14_lp151.28.67-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-qt-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-vnc-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-websrv-6.0.24-lp151.2.18.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "openSUSE Leap 15.1:python3-virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-devel-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-desktop-icons-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-tools-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-x11-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-host-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-kmp-default-6.0.24_k4.12.14_lp151.28.67-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-qt-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-vnc-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-websrv-6.0.24-lp151.2.18.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2020-09-23T22:20:49Z",
               details: "important",
            },
         ],
         title: "CVE-2020-14676",
      },
      {
         cve: "CVE-2020-14677",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2020-14677",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Leap 15.1:python3-virtualbox-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-devel-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-guest-desktop-icons-6.0.24-lp151.2.18.1.noarch",
               "openSUSE Leap 15.1:virtualbox-guest-source-6.0.24-lp151.2.18.1.noarch",
               "openSUSE Leap 15.1:virtualbox-guest-tools-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-guest-x11-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-host-source-6.0.24-lp151.2.18.1.noarch",
               "openSUSE Leap 15.1:virtualbox-kmp-default-6.0.24_k4.12.14_lp151.28.67-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-qt-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-vnc-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-websrv-6.0.24-lp151.2.18.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2020-14677",
               url: "https://www.suse.com/security/cve/CVE-2020-14677",
            },
            {
               category: "external",
               summary: "SUSE Bug 1174159 for CVE-2020-14677",
               url: "https://bugzilla.suse.com/1174159",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Leap 15.1:python3-virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-devel-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-desktop-icons-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-tools-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-x11-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-host-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-kmp-default-6.0.24_k4.12.14_lp151.28.67-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-qt-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-vnc-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-websrv-6.0.24-lp151.2.18.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "openSUSE Leap 15.1:python3-virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-devel-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-desktop-icons-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-tools-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-x11-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-host-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-kmp-default-6.0.24_k4.12.14_lp151.28.67-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-qt-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-vnc-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-websrv-6.0.24-lp151.2.18.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2020-09-23T22:20:49Z",
               details: "important",
            },
         ],
         title: "CVE-2020-14677",
      },
      {
         cve: "CVE-2020-14694",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2020-14694",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N).",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Leap 15.1:python3-virtualbox-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-devel-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-guest-desktop-icons-6.0.24-lp151.2.18.1.noarch",
               "openSUSE Leap 15.1:virtualbox-guest-source-6.0.24-lp151.2.18.1.noarch",
               "openSUSE Leap 15.1:virtualbox-guest-tools-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-guest-x11-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-host-source-6.0.24-lp151.2.18.1.noarch",
               "openSUSE Leap 15.1:virtualbox-kmp-default-6.0.24_k4.12.14_lp151.28.67-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-qt-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-vnc-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-websrv-6.0.24-lp151.2.18.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2020-14694",
               url: "https://www.suse.com/security/cve/CVE-2020-14694",
            },
            {
               category: "external",
               summary: "SUSE Bug 1174159 for CVE-2020-14694",
               url: "https://bugzilla.suse.com/1174159",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Leap 15.1:python3-virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-devel-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-desktop-icons-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-tools-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-x11-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-host-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-kmp-default-6.0.24_k4.12.14_lp151.28.67-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-qt-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-vnc-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-websrv-6.0.24-lp151.2.18.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N",
                  version: "3.1",
               },
               products: [
                  "openSUSE Leap 15.1:python3-virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-devel-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-desktop-icons-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-tools-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-x11-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-host-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-kmp-default-6.0.24_k4.12.14_lp151.28.67-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-qt-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-vnc-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-websrv-6.0.24-lp151.2.18.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2020-09-23T22:20:49Z",
               details: "moderate",
            },
         ],
         title: "CVE-2020-14694",
      },
      {
         cve: "CVE-2020-14695",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2020-14695",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N).",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Leap 15.1:python3-virtualbox-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-devel-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-guest-desktop-icons-6.0.24-lp151.2.18.1.noarch",
               "openSUSE Leap 15.1:virtualbox-guest-source-6.0.24-lp151.2.18.1.noarch",
               "openSUSE Leap 15.1:virtualbox-guest-tools-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-guest-x11-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-host-source-6.0.24-lp151.2.18.1.noarch",
               "openSUSE Leap 15.1:virtualbox-kmp-default-6.0.24_k4.12.14_lp151.28.67-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-qt-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-vnc-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-websrv-6.0.24-lp151.2.18.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2020-14695",
               url: "https://www.suse.com/security/cve/CVE-2020-14695",
            },
            {
               category: "external",
               summary: "SUSE Bug 1174159 for CVE-2020-14695",
               url: "https://bugzilla.suse.com/1174159",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Leap 15.1:python3-virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-devel-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-desktop-icons-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-tools-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-x11-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-host-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-kmp-default-6.0.24_k4.12.14_lp151.28.67-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-qt-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-vnc-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-websrv-6.0.24-lp151.2.18.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N",
                  version: "3.1",
               },
               products: [
                  "openSUSE Leap 15.1:python3-virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-devel-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-desktop-icons-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-tools-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-x11-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-host-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-kmp-default-6.0.24_k4.12.14_lp151.28.67-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-qt-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-vnc-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-websrv-6.0.24-lp151.2.18.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2020-09-23T22:20:49Z",
               details: "moderate",
            },
         ],
         title: "CVE-2020-14695",
      },
      {
         cve: "CVE-2020-14698",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2020-14698",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N).",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Leap 15.1:python3-virtualbox-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-devel-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-guest-desktop-icons-6.0.24-lp151.2.18.1.noarch",
               "openSUSE Leap 15.1:virtualbox-guest-source-6.0.24-lp151.2.18.1.noarch",
               "openSUSE Leap 15.1:virtualbox-guest-tools-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-guest-x11-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-host-source-6.0.24-lp151.2.18.1.noarch",
               "openSUSE Leap 15.1:virtualbox-kmp-default-6.0.24_k4.12.14_lp151.28.67-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-qt-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-vnc-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-websrv-6.0.24-lp151.2.18.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2020-14698",
               url: "https://www.suse.com/security/cve/CVE-2020-14698",
            },
            {
               category: "external",
               summary: "SUSE Bug 1174159 for CVE-2020-14698",
               url: "https://bugzilla.suse.com/1174159",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Leap 15.1:python3-virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-devel-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-desktop-icons-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-tools-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-x11-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-host-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-kmp-default-6.0.24_k4.12.14_lp151.28.67-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-qt-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-vnc-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-websrv-6.0.24-lp151.2.18.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N",
                  version: "3.1",
               },
               products: [
                  "openSUSE Leap 15.1:python3-virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-devel-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-desktop-icons-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-tools-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-x11-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-host-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-kmp-default-6.0.24_k4.12.14_lp151.28.67-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-qt-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-vnc-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-websrv-6.0.24-lp151.2.18.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2020-09-23T22:20:49Z",
               details: "moderate",
            },
         ],
         title: "CVE-2020-14698",
      },
      {
         cve: "CVE-2020-14699",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2020-14699",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Leap 15.1:python3-virtualbox-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-devel-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-guest-desktop-icons-6.0.24-lp151.2.18.1.noarch",
               "openSUSE Leap 15.1:virtualbox-guest-source-6.0.24-lp151.2.18.1.noarch",
               "openSUSE Leap 15.1:virtualbox-guest-tools-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-guest-x11-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-host-source-6.0.24-lp151.2.18.1.noarch",
               "openSUSE Leap 15.1:virtualbox-kmp-default-6.0.24_k4.12.14_lp151.28.67-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-qt-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-vnc-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-websrv-6.0.24-lp151.2.18.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2020-14699",
               url: "https://www.suse.com/security/cve/CVE-2020-14699",
            },
            {
               category: "external",
               summary: "SUSE Bug 1174159 for CVE-2020-14699",
               url: "https://bugzilla.suse.com/1174159",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Leap 15.1:python3-virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-devel-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-desktop-icons-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-tools-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-x11-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-host-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-kmp-default-6.0.24_k4.12.14_lp151.28.67-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-qt-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-vnc-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-websrv-6.0.24-lp151.2.18.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "openSUSE Leap 15.1:python3-virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-devel-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-desktop-icons-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-tools-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-x11-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-host-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-kmp-default-6.0.24_k4.12.14_lp151.28.67-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-qt-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-vnc-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-websrv-6.0.24-lp151.2.18.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2020-09-23T22:20:49Z",
               details: "important",
            },
         ],
         title: "CVE-2020-14699",
      },
      {
         cve: "CVE-2020-14700",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2020-14700",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N).",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Leap 15.1:python3-virtualbox-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-devel-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-guest-desktop-icons-6.0.24-lp151.2.18.1.noarch",
               "openSUSE Leap 15.1:virtualbox-guest-source-6.0.24-lp151.2.18.1.noarch",
               "openSUSE Leap 15.1:virtualbox-guest-tools-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-guest-x11-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-host-source-6.0.24-lp151.2.18.1.noarch",
               "openSUSE Leap 15.1:virtualbox-kmp-default-6.0.24_k4.12.14_lp151.28.67-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-qt-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-vnc-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-websrv-6.0.24-lp151.2.18.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2020-14700",
               url: "https://www.suse.com/security/cve/CVE-2020-14700",
            },
            {
               category: "external",
               summary: "SUSE Bug 1174159 for CVE-2020-14700",
               url: "https://bugzilla.suse.com/1174159",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Leap 15.1:python3-virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-devel-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-desktop-icons-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-tools-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-x11-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-host-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-kmp-default-6.0.24_k4.12.14_lp151.28.67-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-qt-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-vnc-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-websrv-6.0.24-lp151.2.18.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N",
                  version: "3.1",
               },
               products: [
                  "openSUSE Leap 15.1:python3-virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-devel-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-desktop-icons-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-tools-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-x11-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-host-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-kmp-default-6.0.24_k4.12.14_lp151.28.67-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-qt-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-vnc-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-websrv-6.0.24-lp151.2.18.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2020-09-23T22:20:49Z",
               details: "moderate",
            },
         ],
         title: "CVE-2020-14700",
      },
      {
         cve: "CVE-2020-14703",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2020-14703",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 6.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N).",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Leap 15.1:python3-virtualbox-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-devel-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-guest-desktop-icons-6.0.24-lp151.2.18.1.noarch",
               "openSUSE Leap 15.1:virtualbox-guest-source-6.0.24-lp151.2.18.1.noarch",
               "openSUSE Leap 15.1:virtualbox-guest-tools-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-guest-x11-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-host-source-6.0.24-lp151.2.18.1.noarch",
               "openSUSE Leap 15.1:virtualbox-kmp-default-6.0.24_k4.12.14_lp151.28.67-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-qt-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-vnc-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-websrv-6.0.24-lp151.2.18.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2020-14703",
               url: "https://www.suse.com/security/cve/CVE-2020-14703",
            },
            {
               category: "external",
               summary: "SUSE Bug 1174159 for CVE-2020-14703",
               url: "https://bugzilla.suse.com/1174159",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Leap 15.1:python3-virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-devel-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-desktop-icons-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-tools-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-x11-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-host-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-kmp-default-6.0.24_k4.12.14_lp151.28.67-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-qt-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-vnc-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-websrv-6.0.24-lp151.2.18.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 6,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
                  version: "3.1",
               },
               products: [
                  "openSUSE Leap 15.1:python3-virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-devel-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-desktop-icons-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-tools-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-x11-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-host-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-kmp-default-6.0.24_k4.12.14_lp151.28.67-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-qt-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-vnc-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-websrv-6.0.24-lp151.2.18.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2020-09-23T22:20:49Z",
               details: "moderate",
            },
         ],
         title: "CVE-2020-14703",
      },
      {
         cve: "CVE-2020-14704",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2020-14704",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 6.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N).",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Leap 15.1:python3-virtualbox-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-devel-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-guest-desktop-icons-6.0.24-lp151.2.18.1.noarch",
               "openSUSE Leap 15.1:virtualbox-guest-source-6.0.24-lp151.2.18.1.noarch",
               "openSUSE Leap 15.1:virtualbox-guest-tools-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-guest-x11-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-host-source-6.0.24-lp151.2.18.1.noarch",
               "openSUSE Leap 15.1:virtualbox-kmp-default-6.0.24_k4.12.14_lp151.28.67-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-qt-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-vnc-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-websrv-6.0.24-lp151.2.18.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2020-14704",
               url: "https://www.suse.com/security/cve/CVE-2020-14704",
            },
            {
               category: "external",
               summary: "SUSE Bug 1174159 for CVE-2020-14704",
               url: "https://bugzilla.suse.com/1174159",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Leap 15.1:python3-virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-devel-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-desktop-icons-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-tools-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-x11-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-host-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-kmp-default-6.0.24_k4.12.14_lp151.28.67-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-qt-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-vnc-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-websrv-6.0.24-lp151.2.18.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 6,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
                  version: "3.1",
               },
               products: [
                  "openSUSE Leap 15.1:python3-virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-devel-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-desktop-icons-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-tools-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-x11-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-host-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-kmp-default-6.0.24_k4.12.14_lp151.28.67-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-qt-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-vnc-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-websrv-6.0.24-lp151.2.18.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2020-09-23T22:20:49Z",
               details: "moderate",
            },
         ],
         title: "CVE-2020-14704",
      },
      {
         cve: "CVE-2020-14707",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2020-14707",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 5.0 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H).",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Leap 15.1:python3-virtualbox-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-devel-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-guest-desktop-icons-6.0.24-lp151.2.18.1.noarch",
               "openSUSE Leap 15.1:virtualbox-guest-source-6.0.24-lp151.2.18.1.noarch",
               "openSUSE Leap 15.1:virtualbox-guest-tools-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-guest-x11-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-host-source-6.0.24-lp151.2.18.1.noarch",
               "openSUSE Leap 15.1:virtualbox-kmp-default-6.0.24_k4.12.14_lp151.28.67-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-qt-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-vnc-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-websrv-6.0.24-lp151.2.18.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2020-14707",
               url: "https://www.suse.com/security/cve/CVE-2020-14707",
            },
            {
               category: "external",
               summary: "SUSE Bug 1174159 for CVE-2020-14707",
               url: "https://bugzilla.suse.com/1174159",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Leap 15.1:python3-virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-devel-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-desktop-icons-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-tools-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-x11-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-host-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-kmp-default-6.0.24_k4.12.14_lp151.28.67-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-qt-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-vnc-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-websrv-6.0.24-lp151.2.18.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 5,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "openSUSE Leap 15.1:python3-virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-devel-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-desktop-icons-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-tools-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-x11-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-host-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-kmp-default-6.0.24_k4.12.14_lp151.28.67-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-qt-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-vnc-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-websrv-6.0.24-lp151.2.18.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2020-09-23T22:20:49Z",
               details: "moderate",
            },
         ],
         title: "CVE-2020-14707",
      },
      {
         cve: "CVE-2020-14711",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2020-14711",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. Note: The CVE-2020-14711 is applicable to macOS host only. CVSS 3.1 Base Score 6.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H).",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Leap 15.1:python3-virtualbox-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-devel-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-guest-desktop-icons-6.0.24-lp151.2.18.1.noarch",
               "openSUSE Leap 15.1:virtualbox-guest-source-6.0.24-lp151.2.18.1.noarch",
               "openSUSE Leap 15.1:virtualbox-guest-tools-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-guest-x11-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-host-source-6.0.24-lp151.2.18.1.noarch",
               "openSUSE Leap 15.1:virtualbox-kmp-default-6.0.24_k4.12.14_lp151.28.67-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-qt-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-vnc-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-websrv-6.0.24-lp151.2.18.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2020-14711",
               url: "https://www.suse.com/security/cve/CVE-2020-14711",
            },
            {
               category: "external",
               summary: "SUSE Bug 1174159 for CVE-2020-14711",
               url: "https://bugzilla.suse.com/1174159",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Leap 15.1:python3-virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-devel-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-desktop-icons-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-tools-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-x11-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-host-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-kmp-default-6.0.24_k4.12.14_lp151.28.67-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-qt-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-vnc-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-websrv-6.0.24-lp151.2.18.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 6.5,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "openSUSE Leap 15.1:python3-virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-devel-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-desktop-icons-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-tools-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-x11-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-host-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-kmp-default-6.0.24_k4.12.14_lp151.28.67-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-qt-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-vnc-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-websrv-6.0.24-lp151.2.18.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2020-09-23T22:20:49Z",
               details: "moderate",
            },
         ],
         title: "CVE-2020-14711",
      },
      {
         cve: "CVE-2020-14712",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2020-14712",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 5.0 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N).",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Leap 15.1:python3-virtualbox-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-devel-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-guest-desktop-icons-6.0.24-lp151.2.18.1.noarch",
               "openSUSE Leap 15.1:virtualbox-guest-source-6.0.24-lp151.2.18.1.noarch",
               "openSUSE Leap 15.1:virtualbox-guest-tools-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-guest-x11-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-host-source-6.0.24-lp151.2.18.1.noarch",
               "openSUSE Leap 15.1:virtualbox-kmp-default-6.0.24_k4.12.14_lp151.28.67-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-qt-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-vnc-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-websrv-6.0.24-lp151.2.18.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2020-14712",
               url: "https://www.suse.com/security/cve/CVE-2020-14712",
            },
            {
               category: "external",
               summary: "SUSE Bug 1174159 for CVE-2020-14712",
               url: "https://bugzilla.suse.com/1174159",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Leap 15.1:python3-virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-devel-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-desktop-icons-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-tools-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-x11-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-host-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-kmp-default-6.0.24_k4.12.14_lp151.28.67-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-qt-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-vnc-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-websrv-6.0.24-lp151.2.18.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 5,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N",
                  version: "3.1",
               },
               products: [
                  "openSUSE Leap 15.1:python3-virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-devel-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-desktop-icons-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-tools-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-x11-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-host-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-kmp-default-6.0.24_k4.12.14_lp151.28.67-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-qt-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-vnc-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-websrv-6.0.24-lp151.2.18.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2020-09-23T22:20:49Z",
               details: "moderate",
            },
         ],
         title: "CVE-2020-14712",
      },
      {
         cve: "CVE-2020-14713",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2020-14713",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Leap 15.1:python3-virtualbox-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-devel-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-guest-desktop-icons-6.0.24-lp151.2.18.1.noarch",
               "openSUSE Leap 15.1:virtualbox-guest-source-6.0.24-lp151.2.18.1.noarch",
               "openSUSE Leap 15.1:virtualbox-guest-tools-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-guest-x11-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-host-source-6.0.24-lp151.2.18.1.noarch",
               "openSUSE Leap 15.1:virtualbox-kmp-default-6.0.24_k4.12.14_lp151.28.67-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-qt-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-vnc-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-websrv-6.0.24-lp151.2.18.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2020-14713",
               url: "https://www.suse.com/security/cve/CVE-2020-14713",
            },
            {
               category: "external",
               summary: "SUSE Bug 1174159 for CVE-2020-14713",
               url: "https://bugzilla.suse.com/1174159",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Leap 15.1:python3-virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-devel-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-desktop-icons-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-tools-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-x11-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-host-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-kmp-default-6.0.24_k4.12.14_lp151.28.67-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-qt-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-vnc-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-websrv-6.0.24-lp151.2.18.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "openSUSE Leap 15.1:python3-virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-devel-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-desktop-icons-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-tools-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-x11-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-host-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-kmp-default-6.0.24_k4.12.14_lp151.28.67-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-qt-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-vnc-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-websrv-6.0.24-lp151.2.18.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2020-09-23T22:20:49Z",
               details: "important",
            },
         ],
         title: "CVE-2020-14713",
      },
      {
         cve: "CVE-2020-14714",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2020-14714",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Leap 15.1:python3-virtualbox-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-devel-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-guest-desktop-icons-6.0.24-lp151.2.18.1.noarch",
               "openSUSE Leap 15.1:virtualbox-guest-source-6.0.24-lp151.2.18.1.noarch",
               "openSUSE Leap 15.1:virtualbox-guest-tools-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-guest-x11-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-host-source-6.0.24-lp151.2.18.1.noarch",
               "openSUSE Leap 15.1:virtualbox-kmp-default-6.0.24_k4.12.14_lp151.28.67-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-qt-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-vnc-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-websrv-6.0.24-lp151.2.18.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2020-14714",
               url: "https://www.suse.com/security/cve/CVE-2020-14714",
            },
            {
               category: "external",
               summary: "SUSE Bug 1174159 for CVE-2020-14714",
               url: "https://bugzilla.suse.com/1174159",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Leap 15.1:python3-virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-devel-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-desktop-icons-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-tools-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-x11-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-host-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-kmp-default-6.0.24_k4.12.14_lp151.28.67-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-qt-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-vnc-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-websrv-6.0.24-lp151.2.18.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 4.4,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "openSUSE Leap 15.1:python3-virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-devel-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-desktop-icons-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-tools-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-x11-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-host-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-kmp-default-6.0.24_k4.12.14_lp151.28.67-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-qt-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-vnc-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-websrv-6.0.24-lp151.2.18.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2020-09-23T22:20:49Z",
               details: "moderate",
            },
         ],
         title: "CVE-2020-14714",
      },
      {
         cve: "CVE-2020-14715",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2020-14715",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Leap 15.1:python3-virtualbox-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-devel-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-guest-desktop-icons-6.0.24-lp151.2.18.1.noarch",
               "openSUSE Leap 15.1:virtualbox-guest-source-6.0.24-lp151.2.18.1.noarch",
               "openSUSE Leap 15.1:virtualbox-guest-tools-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-guest-x11-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-host-source-6.0.24-lp151.2.18.1.noarch",
               "openSUSE Leap 15.1:virtualbox-kmp-default-6.0.24_k4.12.14_lp151.28.67-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-qt-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-vnc-6.0.24-lp151.2.18.1.x86_64",
               "openSUSE Leap 15.1:virtualbox-websrv-6.0.24-lp151.2.18.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2020-14715",
               url: "https://www.suse.com/security/cve/CVE-2020-14715",
            },
            {
               category: "external",
               summary: "SUSE Bug 1174159 for CVE-2020-14715",
               url: "https://bugzilla.suse.com/1174159",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Leap 15.1:python3-virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-devel-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-desktop-icons-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-tools-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-x11-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-host-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-kmp-default-6.0.24_k4.12.14_lp151.28.67-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-qt-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-vnc-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-websrv-6.0.24-lp151.2.18.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 4.4,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "openSUSE Leap 15.1:python3-virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-devel-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-desktop-icons-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-guest-tools-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-guest-x11-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-host-source-6.0.24-lp151.2.18.1.noarch",
                  "openSUSE Leap 15.1:virtualbox-kmp-default-6.0.24_k4.12.14_lp151.28.67-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-qt-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-vnc-6.0.24-lp151.2.18.1.x86_64",
                  "openSUSE Leap 15.1:virtualbox-websrv-6.0.24-lp151.2.18.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2020-09-23T22:20:49Z",
               details: "moderate",
            },
         ],
         title: "CVE-2020-14715",
      },
   ],
}

cve-2020-14646

Vulnerability from cvelistv5

Published

2020-07-15 17:34

Modified

2024-09-27 18:27

Severity ?

7.5 (High) - CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Summary

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).

References

▼	URL	Tags
	https://www.oracle.com/security-alerts/cpujul2020.html	x_refsource_MISC
	https://www.zerodayinitiative.com/advisories/ZDI-20-888/	x_refsource_MISC
	http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html	vendor-advisory, x_refsource_SUSE
	https://security.gentoo.org/glsa/202101-09	vendor-advisory, x_refsource_GENTOO

Impacted products

	Vendor	Product	Version
	Oracle Corporation	VM VirtualBox	Version: unspecified < 5.2.44 Version: unspecified < 6.0.24 Version: unspecified < 6.1.12

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T12:53:42.357Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpujul2020.html",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-20-888/",
               },
               {
                  name: "openSUSE-SU-2020:1486",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html",
               },
               {
                  name: "openSUSE-SU-2020:1511",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html",
               },
               {
                  name: "GLSA-202101-09",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202101-09",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2020-14646",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-09-27T17:54:56.007989Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-09-27T18:27:41.787Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "VM VirtualBox",
               vendor: "Oracle Corporation",
               versions: [
                  {
                     lessThan: "5.2.44",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
                  {
                     lessThan: "6.0.24",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
                  {
                     lessThan: "6.1.12",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "HIGH",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "HIGH",
                  scope: "CHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products.  Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox.",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2021-01-12T19:06:51",
            orgId: "43595867-4340-4103-b7a2-9a5208d29a85",
            shortName: "oracle",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpujul2020.html",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.zerodayinitiative.com/advisories/ZDI-20-888/",
            },
            {
               name: "openSUSE-SU-2020:1486",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html",
            },
            {
               name: "openSUSE-SU-2020:1511",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html",
            },
            {
               name: "GLSA-202101-09",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/202101-09",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "secalert_us@oracle.com",
               ID: "CVE-2020-14646",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "VM VirtualBox",
                                 version: {
                                    version_data: [
                                       {
                                          version_affected: "<",
                                          version_value: "5.2.44",
                                       },
                                       {
                                          version_affected: "<",
                                          version_value: "6.0.24",
                                       },
                                       {
                                          version_affected: "<",
                                          version_value: "6.1.12",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "Oracle Corporation",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).",
                  },
               ],
            },
            impact: {
               cvss: {
                  baseScore: "7.5",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
                  version: "3.1",
               },
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products.  Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox.",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://www.oracle.com/security-alerts/cpujul2020.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpujul2020.html",
                  },
                  {
                     name: "https://www.zerodayinitiative.com/advisories/ZDI-20-888/",
                     refsource: "MISC",
                     url: "https://www.zerodayinitiative.com/advisories/ZDI-20-888/",
                  },
                  {
                     name: "openSUSE-SU-2020:1486",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html",
                  },
                  {
                     name: "openSUSE-SU-2020:1511",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html",
                  },
                  {
                     name: "GLSA-202101-09",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/202101-09",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "43595867-4340-4103-b7a2-9a5208d29a85",
      assignerShortName: "oracle",
      cveId: "CVE-2020-14646",
      datePublished: "2020-07-15T17:34:31",
      dateReserved: "2020-06-19T00:00:00",
      dateUpdated: "2024-09-27T18:27:41.787Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2020-14676

Vulnerability from cvelistv5

Published

2020-07-15 17:34

Modified

2024-09-27 18:24

Severity ?

7.5 (High) - CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Summary

References

▼	URL	Tags
	https://www.oracle.com/security-alerts/cpujul2020.html	x_refsource_MISC
	https://www.zerodayinitiative.com/advisories/ZDI-20-894/	x_refsource_MISC
	http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html	vendor-advisory, x_refsource_SUSE
	https://security.gentoo.org/glsa/202101-09	vendor-advisory, x_refsource_GENTOO

Impacted products

	Vendor	Product	Version
	Oracle Corporation	VM VirtualBox	Version: unspecified < 5.2.44 Version: unspecified < 6.0.24 Version: unspecified < 6.1.12

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T12:53:42.742Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpujul2020.html",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-20-894/",
               },
               {
                  name: "openSUSE-SU-2020:1486",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html",
               },
               {
                  name: "openSUSE-SU-2020:1511",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html",
               },
               {
                  name: "GLSA-202101-09",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202101-09",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2020-14676",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-09-27T17:54:47.279335Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-09-27T18:24:07.143Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "VM VirtualBox",
               vendor: "Oracle Corporation",
               versions: [
                  {
                     lessThan: "5.2.44",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
                  {
                     lessThan: "6.0.24",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
                  {
                     lessThan: "6.1.12",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "HIGH",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "HIGH",
                  scope: "CHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products.  Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox.",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2021-01-12T19:06:25",
            orgId: "43595867-4340-4103-b7a2-9a5208d29a85",
            shortName: "oracle",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpujul2020.html",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.zerodayinitiative.com/advisories/ZDI-20-894/",
            },
            {
               name: "openSUSE-SU-2020:1486",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html",
            },
            {
               name: "openSUSE-SU-2020:1511",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html",
            },
            {
               name: "GLSA-202101-09",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/202101-09",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "secalert_us@oracle.com",
               ID: "CVE-2020-14676",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "VM VirtualBox",
                                 version: {
                                    version_data: [
                                       {
                                          version_affected: "<",
                                          version_value: "5.2.44",
                                       },
                                       {
                                          version_affected: "<",
                                          version_value: "6.0.24",
                                       },
                                       {
                                          version_affected: "<",
                                          version_value: "6.1.12",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "Oracle Corporation",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).",
                  },
               ],
            },
            impact: {
               cvss: {
                  baseScore: "7.5",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
                  version: "3.1",
               },
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products.  Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox.",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://www.oracle.com/security-alerts/cpujul2020.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpujul2020.html",
                  },
                  {
                     name: "https://www.zerodayinitiative.com/advisories/ZDI-20-894/",
                     refsource: "MISC",
                     url: "https://www.zerodayinitiative.com/advisories/ZDI-20-894/",
                  },
                  {
                     name: "openSUSE-SU-2020:1486",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html",
                  },
                  {
                     name: "openSUSE-SU-2020:1511",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html",
                  },
                  {
                     name: "GLSA-202101-09",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/202101-09",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "43595867-4340-4103-b7a2-9a5208d29a85",
      assignerShortName: "oracle",
      cveId: "CVE-2020-14676",
      datePublished: "2020-07-15T17:34:33",
      dateReserved: "2020-06-19T00:00:00",
      dateUpdated: "2024-09-27T18:24:07.143Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2020-14699

Vulnerability from cvelistv5

Published

2020-07-15 17:34

Modified

2024-09-26 20:40

Severity ?

7.5 (High) - CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Summary

References

▼	URL	Tags
	https://www.oracle.com/security-alerts/cpujul2020.html	x_refsource_MISC
	https://www.zerodayinitiative.com/advisories/ZDI-20-902/	x_refsource_MISC
	http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html	vendor-advisory, x_refsource_SUSE
	https://security.gentoo.org/glsa/202101-09	vendor-advisory, x_refsource_GENTOO

Impacted products

	Vendor	Product	Version
	Oracle Corporation	VM VirtualBox	Version: unspecified < 5.2.44 Version: unspecified < 6.0.24 Version: unspecified < 6.1.12

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T12:53:43.277Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpujul2020.html",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-20-902/",
               },
               {
                  name: "openSUSE-SU-2020:1486",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html",
               },
               {
                  name: "openSUSE-SU-2020:1511",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html",
               },
               {
                  name: "GLSA-202101-09",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202101-09",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2020-14699",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-09-26T19:54:26.439348Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-09-26T20:40:34.335Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "VM VirtualBox",
               vendor: "Oracle Corporation",
               versions: [
                  {
                     lessThan: "5.2.44",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
                  {
                     lessThan: "6.0.24",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
                  {
                     lessThan: "6.1.12",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "HIGH",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "HIGH",
                  scope: "CHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products.  Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox.",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2021-01-12T19:06:26",
            orgId: "43595867-4340-4103-b7a2-9a5208d29a85",
            shortName: "oracle",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpujul2020.html",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.zerodayinitiative.com/advisories/ZDI-20-902/",
            },
            {
               name: "openSUSE-SU-2020:1486",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html",
            },
            {
               name: "openSUSE-SU-2020:1511",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html",
            },
            {
               name: "GLSA-202101-09",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/202101-09",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "secalert_us@oracle.com",
               ID: "CVE-2020-14699",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "VM VirtualBox",
                                 version: {
                                    version_data: [
                                       {
                                          version_affected: "<",
                                          version_value: "5.2.44",
                                       },
                                       {
                                          version_affected: "<",
                                          version_value: "6.0.24",
                                       },
                                       {
                                          version_affected: "<",
                                          version_value: "6.1.12",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "Oracle Corporation",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).",
                  },
               ],
            },
            impact: {
               cvss: {
                  baseScore: "7.5",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
                  version: "3.1",
               },
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products.  Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox.",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://www.oracle.com/security-alerts/cpujul2020.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpujul2020.html",
                  },
                  {
                     name: "https://www.zerodayinitiative.com/advisories/ZDI-20-902/",
                     refsource: "MISC",
                     url: "https://www.zerodayinitiative.com/advisories/ZDI-20-902/",
                  },
                  {
                     name: "openSUSE-SU-2020:1486",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html",
                  },
                  {
                     name: "openSUSE-SU-2020:1511",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html",
                  },
                  {
                     name: "GLSA-202101-09",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/202101-09",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "43595867-4340-4103-b7a2-9a5208d29a85",
      assignerShortName: "oracle",
      cveId: "CVE-2020-14699",
      datePublished: "2020-07-15T17:34:34",
      dateReserved: "2020-06-19T00:00:00",
      dateUpdated: "2024-09-26T20:40:34.335Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2020-14629

Vulnerability from cvelistv5

Published

2020-07-15 17:34

Modified

2024-09-27 18:30

Severity ?

6.0 (Medium) - CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Summary

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 6.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N).

References

▼	URL	Tags
	https://www.oracle.com/security-alerts/cpujul2020.html	x_refsource_MISC
	https://www.zerodayinitiative.com/advisories/ZDI-20-887/	x_refsource_MISC
	http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html	vendor-advisory, x_refsource_SUSE
	https://security.gentoo.org/glsa/202101-09	vendor-advisory, x_refsource_GENTOO

Impacted products

	Vendor	Product	Version
	Oracle Corporation	VM VirtualBox	Version: unspecified < 5.2.44 Version: unspecified < 6.0.24 Version: unspecified < 6.1.12

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T12:53:42.601Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpujul2020.html",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-20-887/",
               },
               {
                  name: "openSUSE-SU-2020:1486",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html",
               },
               {
                  name: "openSUSE-SU-2020:1511",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html",
               },
               {
                  name: "GLSA-202101-09",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202101-09",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2020-14629",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-09-27T17:58:00.948436Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-09-27T18:30:07.569Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "VM VirtualBox",
               vendor: "Oracle Corporation",
               versions: [
                  {
                     lessThan: "5.2.44",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
                  {
                     lessThan: "6.0.24",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
                  {
                     lessThan: "6.1.12",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 6.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N).",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "NONE",
                  baseScore: 6,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "NONE",
                  privilegesRequired: "HIGH",
                  scope: "CHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data.",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2021-01-12T19:06:36",
            orgId: "43595867-4340-4103-b7a2-9a5208d29a85",
            shortName: "oracle",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpujul2020.html",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.zerodayinitiative.com/advisories/ZDI-20-887/",
            },
            {
               name: "openSUSE-SU-2020:1486",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html",
            },
            {
               name: "openSUSE-SU-2020:1511",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html",
            },
            {
               name: "GLSA-202101-09",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/202101-09",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "secalert_us@oracle.com",
               ID: "CVE-2020-14629",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "VM VirtualBox",
                                 version: {
                                    version_data: [
                                       {
                                          version_affected: "<",
                                          version_value: "5.2.44",
                                       },
                                       {
                                          version_affected: "<",
                                          version_value: "6.0.24",
                                       },
                                       {
                                          version_affected: "<",
                                          version_value: "6.1.12",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "Oracle Corporation",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 6.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N).",
                  },
               ],
            },
            impact: {
               cvss: {
                  baseScore: "6.0",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
                  version: "3.1",
               },
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data.",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://www.oracle.com/security-alerts/cpujul2020.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpujul2020.html",
                  },
                  {
                     name: "https://www.zerodayinitiative.com/advisories/ZDI-20-887/",
                     refsource: "MISC",
                     url: "https://www.zerodayinitiative.com/advisories/ZDI-20-887/",
                  },
                  {
                     name: "openSUSE-SU-2020:1486",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html",
                  },
                  {
                     name: "openSUSE-SU-2020:1511",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html",
                  },
                  {
                     name: "GLSA-202101-09",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/202101-09",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "43595867-4340-4103-b7a2-9a5208d29a85",
      assignerShortName: "oracle",
      cveId: "CVE-2020-14629",
      datePublished: "2020-07-15T17:34:31",
      dateReserved: "2020-06-19T00:00:00",
      dateUpdated: "2024-09-27T18:30:07.569Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2020-14647

Vulnerability from cvelistv5

Published

2020-07-15 17:34

Modified

2024-09-27 18:27

Severity ?

7.5 (High) - CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Summary

References

▼	URL	Tags
	https://www.oracle.com/security-alerts/cpujul2020.html	x_refsource_MISC
	https://www.zerodayinitiative.com/advisories/ZDI-20-890/	x_refsource_MISC
	http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html	vendor-advisory, x_refsource_SUSE
	https://security.gentoo.org/glsa/202101-09	vendor-advisory, x_refsource_GENTOO

Impacted products

	Vendor	Product	Version
	Oracle Corporation	VM VirtualBox	Version: unspecified < 5.2.44 Version: unspecified < 6.0.24 Version: unspecified < 6.1.12

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T12:53:42.524Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpujul2020.html",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-20-890/",
               },
               {
                  name: "openSUSE-SU-2020:1486",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html",
               },
               {
                  name: "openSUSE-SU-2020:1511",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html",
               },
               {
                  name: "GLSA-202101-09",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202101-09",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2020-14647",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-09-27T17:54:54.619399Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-09-27T18:27:34.508Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "VM VirtualBox",
               vendor: "Oracle Corporation",
               versions: [
                  {
                     lessThan: "5.2.44",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
                  {
                     lessThan: "6.0.24",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
                  {
                     lessThan: "6.1.12",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "HIGH",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "HIGH",
                  scope: "CHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products.  Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox.",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2021-01-12T19:07:17",
            orgId: "43595867-4340-4103-b7a2-9a5208d29a85",
            shortName: "oracle",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpujul2020.html",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.zerodayinitiative.com/advisories/ZDI-20-890/",
            },
            {
               name: "openSUSE-SU-2020:1486",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html",
            },
            {
               name: "openSUSE-SU-2020:1511",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html",
            },
            {
               name: "GLSA-202101-09",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/202101-09",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "secalert_us@oracle.com",
               ID: "CVE-2020-14647",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "VM VirtualBox",
                                 version: {
                                    version_data: [
                                       {
                                          version_affected: "<",
                                          version_value: "5.2.44",
                                       },
                                       {
                                          version_affected: "<",
                                          version_value: "6.0.24",
                                       },
                                       {
                                          version_affected: "<",
                                          version_value: "6.1.12",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "Oracle Corporation",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).",
                  },
               ],
            },
            impact: {
               cvss: {
                  baseScore: "7.5",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
                  version: "3.1",
               },
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products.  Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox.",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://www.oracle.com/security-alerts/cpujul2020.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpujul2020.html",
                  },
                  {
                     name: "https://www.zerodayinitiative.com/advisories/ZDI-20-890/",
                     refsource: "MISC",
                     url: "https://www.zerodayinitiative.com/advisories/ZDI-20-890/",
                  },
                  {
                     name: "openSUSE-SU-2020:1486",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html",
                  },
                  {
                     name: "openSUSE-SU-2020:1511",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html",
                  },
                  {
                     name: "GLSA-202101-09",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/202101-09",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "43595867-4340-4103-b7a2-9a5208d29a85",
      assignerShortName: "oracle",
      cveId: "CVE-2020-14647",
      datePublished: "2020-07-15T17:34:31",
      dateReserved: "2020-06-19T00:00:00",
      dateUpdated: "2024-09-27T18:27:34.508Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2020-14703

Vulnerability from cvelistv5

Published

2020-07-15 17:34

Modified

2024-09-26 20:39

Severity ?

6.0 (Medium) - CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Summary

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 6.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N).

References

▼	URL	Tags
	https://www.oracle.com/security-alerts/cpujul2020.html	x_refsource_MISC
	https://www.zerodayinitiative.com/advisories/ZDI-20-905/	x_refsource_MISC
	http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html	vendor-advisory, x_refsource_SUSE
	https://security.gentoo.org/glsa/202101-09	vendor-advisory, x_refsource_GENTOO

Impacted products

	Vendor	Product	Version
	Oracle Corporation	VM VirtualBox	Version: unspecified < 5.2.44 Version: unspecified < 6.0.24 Version: unspecified < 6.1.12

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T12:53:43.265Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpujul2020.html",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-20-905/",
               },
               {
                  name: "openSUSE-SU-2020:1486",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html",
               },
               {
                  name: "openSUSE-SU-2020:1511",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html",
               },
               {
                  name: "GLSA-202101-09",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202101-09",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2020-14703",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-09-26T19:46:22.595362Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-09-26T20:39:52.526Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "VM VirtualBox",
               vendor: "Oracle Corporation",
               versions: [
                  {
                     lessThan: "5.2.44",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
                  {
                     lessThan: "6.0.24",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
                  {
                     lessThan: "6.1.12",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 6.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N).",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "NONE",
                  baseScore: 6,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "NONE",
                  privilegesRequired: "HIGH",
                  scope: "CHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data.",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2021-01-12T19:07:09",
            orgId: "43595867-4340-4103-b7a2-9a5208d29a85",
            shortName: "oracle",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpujul2020.html",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.zerodayinitiative.com/advisories/ZDI-20-905/",
            },
            {
               name: "openSUSE-SU-2020:1486",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html",
            },
            {
               name: "openSUSE-SU-2020:1511",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html",
            },
            {
               name: "GLSA-202101-09",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/202101-09",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "secalert_us@oracle.com",
               ID: "CVE-2020-14703",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "VM VirtualBox",
                                 version: {
                                    version_data: [
                                       {
                                          version_affected: "<",
                                          version_value: "5.2.44",
                                       },
                                       {
                                          version_affected: "<",
                                          version_value: "6.0.24",
                                       },
                                       {
                                          version_affected: "<",
                                          version_value: "6.1.12",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "Oracle Corporation",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 6.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N).",
                  },
               ],
            },
            impact: {
               cvss: {
                  baseScore: "6.0",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
                  version: "3.1",
               },
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data.",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://www.oracle.com/security-alerts/cpujul2020.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpujul2020.html",
                  },
                  {
                     name: "https://www.zerodayinitiative.com/advisories/ZDI-20-905/",
                     refsource: "MISC",
                     url: "https://www.zerodayinitiative.com/advisories/ZDI-20-905/",
                  },
                  {
                     name: "openSUSE-SU-2020:1486",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html",
                  },
                  {
                     name: "openSUSE-SU-2020:1511",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html",
                  },
                  {
                     name: "GLSA-202101-09",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/202101-09",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "43595867-4340-4103-b7a2-9a5208d29a85",
      assignerShortName: "oracle",
      cveId: "CVE-2020-14703",
      datePublished: "2020-07-15T17:34:34",
      dateReserved: "2020-06-19T00:00:00",
      dateUpdated: "2024-09-26T20:39:52.526Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2020-14649

Vulnerability from cvelistv5

Published

2020-07-15 17:34

Modified

2024-09-27 18:27

Severity ?

7.5 (High) - CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Summary

References

▼	URL	Tags
	https://www.oracle.com/security-alerts/cpujul2020.html	x_refsource_MISC
	https://www.zerodayinitiative.com/advisories/ZDI-20-891/	x_refsource_MISC
	http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html	vendor-advisory, x_refsource_SUSE
	https://security.gentoo.org/glsa/202101-09	vendor-advisory, x_refsource_GENTOO

Impacted products

	Vendor	Product	Version
	Oracle Corporation	VM VirtualBox	Version: unspecified < 5.2.44 Version: unspecified < 6.0.24 Version: unspecified < 6.1.12

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T12:53:42.837Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpujul2020.html",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-20-891/",
               },
               {
                  name: "openSUSE-SU-2020:1486",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html",
               },
               {
                  name: "openSUSE-SU-2020:1511",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html",
               },
               {
                  name: "GLSA-202101-09",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202101-09",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2020-14649",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-09-27T17:54:53.372198Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-09-27T18:27:17.530Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "VM VirtualBox",
               vendor: "Oracle Corporation",
               versions: [
                  {
                     lessThan: "5.2.44",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
                  {
                     lessThan: "6.0.24",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
                  {
                     lessThan: "6.1.12",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "HIGH",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "HIGH",
                  scope: "CHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products.  Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox.",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2021-01-12T19:06:49",
            orgId: "43595867-4340-4103-b7a2-9a5208d29a85",
            shortName: "oracle",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpujul2020.html",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.zerodayinitiative.com/advisories/ZDI-20-891/",
            },
            {
               name: "openSUSE-SU-2020:1486",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html",
            },
            {
               name: "openSUSE-SU-2020:1511",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html",
            },
            {
               name: "GLSA-202101-09",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/202101-09",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "secalert_us@oracle.com",
               ID: "CVE-2020-14649",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "VM VirtualBox",
                                 version: {
                                    version_data: [
                                       {
                                          version_affected: "<",
                                          version_value: "5.2.44",
                                       },
                                       {
                                          version_affected: "<",
                                          version_value: "6.0.24",
                                       },
                                       {
                                          version_affected: "<",
                                          version_value: "6.1.12",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "Oracle Corporation",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).",
                  },
               ],
            },
            impact: {
               cvss: {
                  baseScore: "7.5",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
                  version: "3.1",
               },
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products.  Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox.",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://www.oracle.com/security-alerts/cpujul2020.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpujul2020.html",
                  },
                  {
                     name: "https://www.zerodayinitiative.com/advisories/ZDI-20-891/",
                     refsource: "MISC",
                     url: "https://www.zerodayinitiative.com/advisories/ZDI-20-891/",
                  },
                  {
                     name: "openSUSE-SU-2020:1486",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html",
                  },
                  {
                     name: "openSUSE-SU-2020:1511",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html",
                  },
                  {
                     name: "GLSA-202101-09",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/202101-09",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "43595867-4340-4103-b7a2-9a5208d29a85",
      assignerShortName: "oracle",
      cveId: "CVE-2020-14649",
      datePublished: "2020-07-15T17:34:32",
      dateReserved: "2020-06-19T00:00:00",
      dateUpdated: "2024-09-27T18:27:17.530Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2020-14694

Vulnerability from cvelistv5

Published

2020-07-15 17:34

Modified

2024-09-26 20:41

Severity ?

5.3 (Medium) - CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N

Summary

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N).

References

▼	URL	Tags
	https://www.oracle.com/security-alerts/cpujul2020.html	x_refsource_MISC
	https://www.zerodayinitiative.com/advisories/ZDI-20-899/	x_refsource_MISC
	http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html	vendor-advisory, x_refsource_SUSE
	https://security.gentoo.org/glsa/202101-09	vendor-advisory, x_refsource_GENTOO

Impacted products

	Vendor	Product	Version
	Oracle Corporation	VM VirtualBox	Version: unspecified < 5.2.44 Version: unspecified < 6.0.24 Version: unspecified < 6.1.12

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T12:53:42.833Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpujul2020.html",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-20-899/",
               },
               {
                  name: "openSUSE-SU-2020:1486",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html",
               },
               {
                  name: "openSUSE-SU-2020:1511",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html",
               },
               {
                  name: "GLSA-202101-09",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202101-09",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2020-14694",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-09-26T19:46:33.189342Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-09-26T20:41:33.116Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "VM VirtualBox",
               vendor: "Oracle Corporation",
               versions: [
                  {
                     lessThan: "5.2.44",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
                  {
                     lessThan: "6.0.24",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
                  {
                     lessThan: "6.1.12",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N).",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "HIGH",
                  attackVector: "LOCAL",
                  availabilityImpact: "NONE",
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "NONE",
                  privilegesRequired: "HIGH",
                  scope: "CHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data.",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2021-01-12T19:07:10",
            orgId: "43595867-4340-4103-b7a2-9a5208d29a85",
            shortName: "oracle",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpujul2020.html",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.zerodayinitiative.com/advisories/ZDI-20-899/",
            },
            {
               name: "openSUSE-SU-2020:1486",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html",
            },
            {
               name: "openSUSE-SU-2020:1511",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html",
            },
            {
               name: "GLSA-202101-09",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/202101-09",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "secalert_us@oracle.com",
               ID: "CVE-2020-14694",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "VM VirtualBox",
                                 version: {
                                    version_data: [
                                       {
                                          version_affected: "<",
                                          version_value: "5.2.44",
                                       },
                                       {
                                          version_affected: "<",
                                          version_value: "6.0.24",
                                       },
                                       {
                                          version_affected: "<",
                                          version_value: "6.1.12",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "Oracle Corporation",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N).",
                  },
               ],
            },
            impact: {
               cvss: {
                  baseScore: "5.3",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N",
                  version: "3.1",
               },
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data.",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://www.oracle.com/security-alerts/cpujul2020.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpujul2020.html",
                  },
                  {
                     name: "https://www.zerodayinitiative.com/advisories/ZDI-20-899/",
                     refsource: "MISC",
                     url: "https://www.zerodayinitiative.com/advisories/ZDI-20-899/",
                  },
                  {
                     name: "openSUSE-SU-2020:1486",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html",
                  },
                  {
                     name: "openSUSE-SU-2020:1511",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html",
                  },
                  {
                     name: "GLSA-202101-09",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/202101-09",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "43595867-4340-4103-b7a2-9a5208d29a85",
      assignerShortName: "oracle",
      cveId: "CVE-2020-14694",
      datePublished: "2020-07-15T17:34:34",
      dateReserved: "2020-06-19T00:00:00",
      dateUpdated: "2024-09-26T20:41:33.116Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2020-14628

Vulnerability from cvelistv5

Published

2020-07-15 17:34

Modified

2024-09-27 18:30

Severity ?

8.2 (High) - CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Summary

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. Note: The CVE-2020-14628 is applicable to Windows VM only. CVSS 3.1 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).

References

▼	URL	Tags
	https://www.oracle.com/security-alerts/cpujul2020.html	x_refsource_MISC
	https://www.zerodayinitiative.com/advisories/ZDI-20-886/	x_refsource_MISC
	http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html	vendor-advisory, x_refsource_SUSE
	https://security.gentoo.org/glsa/202101-09	vendor-advisory, x_refsource_GENTOO

Impacted products

	Vendor	Product	Version
	Oracle Corporation	VM VirtualBox	Version: unspecified < 5.2.44 Version: unspecified < 6.0.24 Version: unspecified < 6.1.12

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T12:53:41.965Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpujul2020.html",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-20-886/",
               },
               {
                  name: "openSUSE-SU-2020:1486",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html",
               },
               {
                  name: "openSUSE-SU-2020:1511",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html",
               },
               {
                  name: "GLSA-202101-09",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202101-09",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2020-14628",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-09-27T17:54:57.367394Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-09-27T18:30:15.503Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "VM VirtualBox",
               vendor: "Oracle Corporation",
               versions: [
                  {
                     lessThan: "5.2.44",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
                  {
                     lessThan: "6.0.24",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
                  {
                     lessThan: "6.1.12",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. Note: The CVE-2020-14628 is applicable to Windows VM only. CVSS 3.1 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 8.2,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "HIGH",
                  scope: "CHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products.  Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox.",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2021-01-12T19:06:25",
            orgId: "43595867-4340-4103-b7a2-9a5208d29a85",
            shortName: "oracle",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpujul2020.html",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.zerodayinitiative.com/advisories/ZDI-20-886/",
            },
            {
               name: "openSUSE-SU-2020:1486",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html",
            },
            {
               name: "openSUSE-SU-2020:1511",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html",
            },
            {
               name: "GLSA-202101-09",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/202101-09",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "secalert_us@oracle.com",
               ID: "CVE-2020-14628",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "VM VirtualBox",
                                 version: {
                                    version_data: [
                                       {
                                          version_affected: "<",
                                          version_value: "5.2.44",
                                       },
                                       {
                                          version_affected: "<",
                                          version_value: "6.0.24",
                                       },
                                       {
                                          version_affected: "<",
                                          version_value: "6.1.12",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "Oracle Corporation",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. Note: The CVE-2020-14628 is applicable to Windows VM only. CVSS 3.1 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).",
                  },
               ],
            },
            impact: {
               cvss: {
                  baseScore: "8.2",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
                  version: "3.1",
               },
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products.  Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox.",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://www.oracle.com/security-alerts/cpujul2020.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpujul2020.html",
                  },
                  {
                     name: "https://www.zerodayinitiative.com/advisories/ZDI-20-886/",
                     refsource: "MISC",
                     url: "https://www.zerodayinitiative.com/advisories/ZDI-20-886/",
                  },
                  {
                     name: "openSUSE-SU-2020:1486",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html",
                  },
                  {
                     name: "openSUSE-SU-2020:1511",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html",
                  },
                  {
                     name: "GLSA-202101-09",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/202101-09",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "43595867-4340-4103-b7a2-9a5208d29a85",
      assignerShortName: "oracle",
      cveId: "CVE-2020-14628",
      datePublished: "2020-07-15T17:34:30",
      dateReserved: "2020-06-19T00:00:00",
      dateUpdated: "2024-09-27T18:30:15.503Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2020-14673

Vulnerability from cvelistv5

Published

2020-07-15 17:34

Modified

2024-09-27 18:24

Severity ?

5.3 (Medium) - CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N

Summary

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N).

References

▼	URL	Tags
	https://www.oracle.com/security-alerts/cpujul2020.html	x_refsource_MISC
	https://www.zerodayinitiative.com/advisories/ZDI-20-898/	x_refsource_MISC
	http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html	vendor-advisory, x_refsource_SUSE
	https://security.gentoo.org/glsa/202101-09	vendor-advisory, x_refsource_GENTOO

Impacted products

	Vendor	Product	Version
	Oracle Corporation	VM VirtualBox	Version: unspecified < 5.2.44 Version: unspecified < 6.0.24 Version: unspecified < 6.1.12

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T12:53:42.808Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpujul2020.html",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-20-898/",
               },
               {
                  name: "openSUSE-SU-2020:1486",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html",
               },
               {
                  name: "openSUSE-SU-2020:1511",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html",
               },
               {
                  name: "GLSA-202101-09",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202101-09",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2020-14673",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-09-27T17:57:08.907714Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-09-27T18:24:33.764Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "VM VirtualBox",
               vendor: "Oracle Corporation",
               versions: [
                  {
                     lessThan: "5.2.44",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
                  {
                     lessThan: "6.0.24",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
                  {
                     lessThan: "6.1.12",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N).",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "HIGH",
                  attackVector: "LOCAL",
                  availabilityImpact: "NONE",
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "NONE",
                  privilegesRequired: "HIGH",
                  scope: "CHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data.",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2021-01-12T19:06:32",
            orgId: "43595867-4340-4103-b7a2-9a5208d29a85",
            shortName: "oracle",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpujul2020.html",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.zerodayinitiative.com/advisories/ZDI-20-898/",
            },
            {
               name: "openSUSE-SU-2020:1486",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html",
            },
            {
               name: "openSUSE-SU-2020:1511",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html",
            },
            {
               name: "GLSA-202101-09",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/202101-09",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "secalert_us@oracle.com",
               ID: "CVE-2020-14673",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "VM VirtualBox",
                                 version: {
                                    version_data: [
                                       {
                                          version_affected: "<",
                                          version_value: "5.2.44",
                                       },
                                       {
                                          version_affected: "<",
                                          version_value: "6.0.24",
                                       },
                                       {
                                          version_affected: "<",
                                          version_value: "6.1.12",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "Oracle Corporation",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N).",
                  },
               ],
            },
            impact: {
               cvss: {
                  baseScore: "5.3",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N",
                  version: "3.1",
               },
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data.",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://www.oracle.com/security-alerts/cpujul2020.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpujul2020.html",
                  },
                  {
                     name: "https://www.zerodayinitiative.com/advisories/ZDI-20-898/",
                     refsource: "MISC",
                     url: "https://www.zerodayinitiative.com/advisories/ZDI-20-898/",
                  },
                  {
                     name: "openSUSE-SU-2020:1486",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html",
                  },
                  {
                     name: "openSUSE-SU-2020:1511",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html",
                  },
                  {
                     name: "GLSA-202101-09",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/202101-09",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "43595867-4340-4103-b7a2-9a5208d29a85",
      assignerShortName: "oracle",
      cveId: "CVE-2020-14673",
      datePublished: "2020-07-15T17:34:33",
      dateReserved: "2020-06-19T00:00:00",
      dateUpdated: "2024-09-27T18:24:33.764Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2020-14704

Vulnerability from cvelistv5

Published

2020-07-15 17:34

Modified

2024-09-26 20:39

Severity ?

6.0 (Medium) - CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Summary

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 6.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N).

References

▼	URL	Tags
	https://www.oracle.com/security-alerts/cpujul2020.html	x_refsource_MISC
	https://www.zerodayinitiative.com/advisories/ZDI-20-904/	x_refsource_MISC
	http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html	vendor-advisory, x_refsource_SUSE
	https://security.gentoo.org/glsa/202101-09	vendor-advisory, x_refsource_GENTOO

Impacted products

	Vendor	Product	Version
	Oracle Corporation	VM VirtualBox	Version: unspecified < 5.2.44 Version: unspecified < 6.0.24 Version: unspecified < 6.1.12

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T12:53:43.206Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpujul2020.html",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-20-904/",
               },
               {
                  name: "openSUSE-SU-2020:1486",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html",
               },
               {
                  name: "openSUSE-SU-2020:1511",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html",
               },
               {
                  name: "GLSA-202101-09",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202101-09",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2020-14704",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-09-26T19:46:21.056038Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-09-26T20:39:40.148Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "VM VirtualBox",
               vendor: "Oracle Corporation",
               versions: [
                  {
                     lessThan: "5.2.44",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
                  {
                     lessThan: "6.0.24",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
                  {
                     lessThan: "6.1.12",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 6.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N).",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "NONE",
                  baseScore: 6,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "NONE",
                  privilegesRequired: "HIGH",
                  scope: "CHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data.",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2021-01-12T19:06:57",
            orgId: "43595867-4340-4103-b7a2-9a5208d29a85",
            shortName: "oracle",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpujul2020.html",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.zerodayinitiative.com/advisories/ZDI-20-904/",
            },
            {
               name: "openSUSE-SU-2020:1486",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html",
            },
            {
               name: "openSUSE-SU-2020:1511",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html",
            },
            {
               name: "GLSA-202101-09",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/202101-09",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "secalert_us@oracle.com",
               ID: "CVE-2020-14704",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "VM VirtualBox",
                                 version: {
                                    version_data: [
                                       {
                                          version_affected: "<",
                                          version_value: "5.2.44",
                                       },
                                       {
                                          version_affected: "<",
                                          version_value: "6.0.24",
                                       },
                                       {
                                          version_affected: "<",
                                          version_value: "6.1.12",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "Oracle Corporation",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 6.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N).",
                  },
               ],
            },
            impact: {
               cvss: {
                  baseScore: "6.0",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
                  version: "3.1",
               },
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data.",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://www.oracle.com/security-alerts/cpujul2020.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpujul2020.html",
                  },
                  {
                     name: "https://www.zerodayinitiative.com/advisories/ZDI-20-904/",
                     refsource: "MISC",
                     url: "https://www.zerodayinitiative.com/advisories/ZDI-20-904/",
                  },
                  {
                     name: "openSUSE-SU-2020:1486",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html",
                  },
                  {
                     name: "openSUSE-SU-2020:1511",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html",
                  },
                  {
                     name: "GLSA-202101-09",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/202101-09",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "43595867-4340-4103-b7a2-9a5208d29a85",
      assignerShortName: "oracle",
      cveId: "CVE-2020-14704",
      datePublished: "2020-07-15T17:34:34",
      dateReserved: "2020-06-19T00:00:00",
      dateUpdated: "2024-09-26T20:39:40.148Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2020-14711

Vulnerability from cvelistv5

Published

2020-07-15 17:34

Modified

2024-09-26 20:38

Severity ?

6.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Summary

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. Note: The CVE-2020-14711 is applicable to macOS host only. CVSS 3.1 Base Score 6.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H).

References

▼	URL	Tags
	https://www.oracle.com/security-alerts/cpujul2020.html	x_refsource_MISC
	http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html	vendor-advisory, x_refsource_SUSE
	https://security.gentoo.org/glsa/202101-09	vendor-advisory, x_refsource_GENTOO

Impacted products

	Vendor	Product	Version
	Oracle Corporation	VM VirtualBox	Version: unspecified < 5.2.44 Version: unspecified < 6.0.24 Version: unspecified < 6.1.12

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T12:53:43.285Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpujul2020.html",
               },
               {
                  name: "openSUSE-SU-2020:1486",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html",
               },
               {
                  name: "openSUSE-SU-2020:1511",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html",
               },
               {
                  name: "GLSA-202101-09",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202101-09",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2020-14711",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-09-26T19:54:21.695356Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-09-26T20:38:09.829Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "VM VirtualBox",
               vendor: "Oracle Corporation",
               versions: [
                  {
                     lessThan: "5.2.44",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
                  {
                     lessThan: "6.0.24",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
                  {
                     lessThan: "6.1.12",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. Note: The CVE-2020-14711 is applicable to macOS host only. CVSS 3.1 Base Score 6.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H).",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 6.5,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "HIGH",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox.",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2021-01-12T19:06:42",
            orgId: "43595867-4340-4103-b7a2-9a5208d29a85",
            shortName: "oracle",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpujul2020.html",
            },
            {
               name: "openSUSE-SU-2020:1486",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html",
            },
            {
               name: "openSUSE-SU-2020:1511",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html",
            },
            {
               name: "GLSA-202101-09",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/202101-09",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "secalert_us@oracle.com",
               ID: "CVE-2020-14711",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "VM VirtualBox",
                                 version: {
                                    version_data: [
                                       {
                                          version_affected: "<",
                                          version_value: "5.2.44",
                                       },
                                       {
                                          version_affected: "<",
                                          version_value: "6.0.24",
                                       },
                                       {
                                          version_affected: "<",
                                          version_value: "6.1.12",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "Oracle Corporation",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. Note: The CVE-2020-14711 is applicable to macOS host only. CVSS 3.1 Base Score 6.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H).",
                  },
               ],
            },
            impact: {
               cvss: {
                  baseScore: "6.5",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox.",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://www.oracle.com/security-alerts/cpujul2020.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpujul2020.html",
                  },
                  {
                     name: "openSUSE-SU-2020:1486",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html",
                  },
                  {
                     name: "openSUSE-SU-2020:1511",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html",
                  },
                  {
                     name: "GLSA-202101-09",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/202101-09",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "43595867-4340-4103-b7a2-9a5208d29a85",
      assignerShortName: "oracle",
      cveId: "CVE-2020-14711",
      datePublished: "2020-07-15T17:34:35",
      dateReserved: "2020-06-19T00:00:00",
      dateUpdated: "2024-09-26T20:38:09.829Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2020-14712

Vulnerability from cvelistv5

Published

2020-07-15 17:34

Modified

2024-09-26 20:37

Severity ?

5.0 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N

Summary

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 5.0 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N).

References

▼	URL	Tags
	https://www.oracle.com/security-alerts/cpujul2020.html	x_refsource_MISC
	http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html	vendor-advisory, x_refsource_SUSE
	https://security.gentoo.org/glsa/202101-09	vendor-advisory, x_refsource_GENTOO

Impacted products

	Vendor	Product	Version
	Oracle Corporation	VM VirtualBox	Version: unspecified < 5.2.44 Version: unspecified < 6.0.24 Version: unspecified < 6.1.12

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T12:53:43.294Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpujul2020.html",
               },
               {
                  name: "openSUSE-SU-2020:1486",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html",
               },
               {
                  name: "openSUSE-SU-2020:1511",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html",
               },
               {
                  name: "GLSA-202101-09",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202101-09",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2020-14712",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-09-26T19:46:10.971299Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-09-26T20:37:59.997Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "VM VirtualBox",
               vendor: "Oracle Corporation",
               versions: [
                  {
                     lessThan: "5.2.44",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
                  {
                     lessThan: "6.0.24",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
                  {
                     lessThan: "6.1.12",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 5.0 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N).",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "NONE",
                  baseScore: 5,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "HIGH",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle VM VirtualBox accessible data.",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2021-01-12T19:06:28",
            orgId: "43595867-4340-4103-b7a2-9a5208d29a85",
            shortName: "oracle",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpujul2020.html",
            },
            {
               name: "openSUSE-SU-2020:1486",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html",
            },
            {
               name: "openSUSE-SU-2020:1511",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html",
            },
            {
               name: "GLSA-202101-09",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/202101-09",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "secalert_us@oracle.com",
               ID: "CVE-2020-14712",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "VM VirtualBox",
                                 version: {
                                    version_data: [
                                       {
                                          version_affected: "<",
                                          version_value: "5.2.44",
                                       },
                                       {
                                          version_affected: "<",
                                          version_value: "6.0.24",
                                       },
                                       {
                                          version_affected: "<",
                                          version_value: "6.1.12",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "Oracle Corporation",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 5.0 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N).",
                  },
               ],
            },
            impact: {
               cvss: {
                  baseScore: "5.0",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N",
                  version: "3.1",
               },
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle VM VirtualBox accessible data.",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://www.oracle.com/security-alerts/cpujul2020.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpujul2020.html",
                  },
                  {
                     name: "openSUSE-SU-2020:1486",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html",
                  },
                  {
                     name: "openSUSE-SU-2020:1511",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html",
                  },
                  {
                     name: "GLSA-202101-09",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/202101-09",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "43595867-4340-4103-b7a2-9a5208d29a85",
      assignerShortName: "oracle",
      cveId: "CVE-2020-14712",
      datePublished: "2020-07-15T17:34:35",
      dateReserved: "2020-06-19T00:00:00",
      dateUpdated: "2024-09-26T20:37:59.997Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2020-14674

Vulnerability from cvelistv5

Published

2020-07-15 17:34

Modified

2024-09-27 18:24

Severity ?

7.5 (High) - CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Summary

References

▼	URL	Tags
	https://www.oracle.com/security-alerts/cpujul2020.html	x_refsource_MISC
	https://www.zerodayinitiative.com/advisories/ZDI-20-896/	x_refsource_MISC
	http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html	vendor-advisory, x_refsource_SUSE
	https://security.gentoo.org/glsa/202101-09	vendor-advisory, x_refsource_GENTOO

Impacted products

	Vendor	Product	Version
	Oracle Corporation	VM VirtualBox	Version: unspecified < 5.2.44 Version: unspecified < 6.0.24 Version: unspecified < 6.1.12

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T12:53:42.674Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpujul2020.html",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-20-896/",
               },
               {
                  name: "openSUSE-SU-2020:1486",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html",
               },
               {
                  name: "openSUSE-SU-2020:1511",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html",
               },
               {
                  name: "GLSA-202101-09",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202101-09",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2020-14674",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-09-27T17:54:49.682020Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-09-27T18:24:26.691Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "VM VirtualBox",
               vendor: "Oracle Corporation",
               versions: [
                  {
                     lessThan: "5.2.44",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
                  {
                     lessThan: "6.0.24",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
                  {
                     lessThan: "6.1.12",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "HIGH",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "HIGH",
                  scope: "CHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products.  Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox.",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2021-01-12T19:07:21",
            orgId: "43595867-4340-4103-b7a2-9a5208d29a85",
            shortName: "oracle",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpujul2020.html",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.zerodayinitiative.com/advisories/ZDI-20-896/",
            },
            {
               name: "openSUSE-SU-2020:1486",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html",
            },
            {
               name: "openSUSE-SU-2020:1511",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html",
            },
            {
               name: "GLSA-202101-09",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/202101-09",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "secalert_us@oracle.com",
               ID: "CVE-2020-14674",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "VM VirtualBox",
                                 version: {
                                    version_data: [
                                       {
                                          version_affected: "<",
                                          version_value: "5.2.44",
                                       },
                                       {
                                          version_affected: "<",
                                          version_value: "6.0.24",
                                       },
                                       {
                                          version_affected: "<",
                                          version_value: "6.1.12",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "Oracle Corporation",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).",
                  },
               ],
            },
            impact: {
               cvss: {
                  baseScore: "7.5",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
                  version: "3.1",
               },
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products.  Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox.",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://www.oracle.com/security-alerts/cpujul2020.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpujul2020.html",
                  },
                  {
                     name: "https://www.zerodayinitiative.com/advisories/ZDI-20-896/",
                     refsource: "MISC",
                     url: "https://www.zerodayinitiative.com/advisories/ZDI-20-896/",
                  },
                  {
                     name: "openSUSE-SU-2020:1486",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html",
                  },
                  {
                     name: "openSUSE-SU-2020:1511",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html",
                  },
                  {
                     name: "GLSA-202101-09",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/202101-09",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "43595867-4340-4103-b7a2-9a5208d29a85",
      assignerShortName: "oracle",
      cveId: "CVE-2020-14674",
      datePublished: "2020-07-15T17:34:33",
      dateReserved: "2020-06-19T00:00:00",
      dateUpdated: "2024-09-27T18:24:26.691Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2020-14715

Vulnerability from cvelistv5

Published

2020-07-15 17:34

Modified

2024-09-26 20:37

Severity ?

4.4 (Medium) - CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Summary

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

References

▼	URL	Tags
	https://www.oracle.com/security-alerts/cpujul2020.html	x_refsource_MISC
	http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html	vendor-advisory, x_refsource_SUSE
	https://security.gentoo.org/glsa/202101-09	vendor-advisory, x_refsource_GENTOO

Impacted products

	Vendor	Product	Version
	Oracle Corporation	VM VirtualBox	Version: unspecified < 5.2.44 Version: unspecified < 6.0.24 Version: unspecified < 6.1.12

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T12:53:43.219Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpujul2020.html",
               },
               {
                  name: "openSUSE-SU-2020:1486",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html",
               },
               {
                  name: "openSUSE-SU-2020:1511",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html",
               },
               {
                  name: "GLSA-202101-09",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202101-09",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2020-14715",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-09-26T19:46:08.259534Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-09-26T20:37:24.770Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "VM VirtualBox",
               vendor: "Oracle Corporation",
               versions: [
                  {
                     lessThan: "5.2.44",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
                  {
                     lessThan: "6.0.24",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
                  {
                     lessThan: "6.1.12",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 4.4,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "HIGH",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox.",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2021-01-12T19:06:47",
            orgId: "43595867-4340-4103-b7a2-9a5208d29a85",
            shortName: "oracle",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpujul2020.html",
            },
            {
               name: "openSUSE-SU-2020:1486",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html",
            },
            {
               name: "openSUSE-SU-2020:1511",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html",
            },
            {
               name: "GLSA-202101-09",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/202101-09",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "secalert_us@oracle.com",
               ID: "CVE-2020-14715",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "VM VirtualBox",
                                 version: {
                                    version_data: [
                                       {
                                          version_affected: "<",
                                          version_value: "5.2.44",
                                       },
                                       {
                                          version_affected: "<",
                                          version_value: "6.0.24",
                                       },
                                       {
                                          version_affected: "<",
                                          version_value: "6.1.12",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "Oracle Corporation",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).",
                  },
               ],
            },
            impact: {
               cvss: {
                  baseScore: "4.4",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox.",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://www.oracle.com/security-alerts/cpujul2020.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpujul2020.html",
                  },
                  {
                     name: "openSUSE-SU-2020:1486",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html",
                  },
                  {
                     name: "openSUSE-SU-2020:1511",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html",
                  },
                  {
                     name: "GLSA-202101-09",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/202101-09",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "43595867-4340-4103-b7a2-9a5208d29a85",
      assignerShortName: "oracle",
      cveId: "CVE-2020-14715",
      datePublished: "2020-07-15T17:34:35",
      dateReserved: "2020-06-19T00:00:00",
      dateUpdated: "2024-09-26T20:37:24.770Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2020-14648

Vulnerability from cvelistv5

Published

2020-07-15 17:34

Modified

2024-09-27 18:27

Severity ?

5.3 (Medium) - CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N

Summary

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N).

References

▼	URL	Tags
	https://www.oracle.com/security-alerts/cpujul2020.html	x_refsource_MISC
	https://www.zerodayinitiative.com/advisories/ZDI-20-889/	x_refsource_MISC
	http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html	vendor-advisory, x_refsource_SUSE
	https://security.gentoo.org/glsa/202101-09	vendor-advisory, x_refsource_GENTOO

Impacted products

	Vendor	Product	Version
	Oracle Corporation	VM VirtualBox	Version: unspecified < 5.2.44 Version: unspecified < 6.0.24 Version: unspecified < 6.1.12

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T12:53:42.753Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpujul2020.html",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-20-889/",
               },
               {
                  name: "openSUSE-SU-2020:1486",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html",
               },
               {
                  name: "openSUSE-SU-2020:1511",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html",
               },
               {
                  name: "GLSA-202101-09",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202101-09",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2020-14648",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-09-27T17:57:33.157792Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-09-27T18:27:26.934Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "VM VirtualBox",
               vendor: "Oracle Corporation",
               versions: [
                  {
                     lessThan: "5.2.44",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
                  {
                     lessThan: "6.0.24",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
                  {
                     lessThan: "6.1.12",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N).",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "HIGH",
                  attackVector: "LOCAL",
                  availabilityImpact: "NONE",
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "NONE",
                  privilegesRequired: "HIGH",
                  scope: "CHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data.",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2021-01-12T19:06:58",
            orgId: "43595867-4340-4103-b7a2-9a5208d29a85",
            shortName: "oracle",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpujul2020.html",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.zerodayinitiative.com/advisories/ZDI-20-889/",
            },
            {
               name: "openSUSE-SU-2020:1486",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html",
            },
            {
               name: "openSUSE-SU-2020:1511",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html",
            },
            {
               name: "GLSA-202101-09",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/202101-09",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "secalert_us@oracle.com",
               ID: "CVE-2020-14648",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "VM VirtualBox",
                                 version: {
                                    version_data: [
                                       {
                                          version_affected: "<",
                                          version_value: "5.2.44",
                                       },
                                       {
                                          version_affected: "<",
                                          version_value: "6.0.24",
                                       },
                                       {
                                          version_affected: "<",
                                          version_value: "6.1.12",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "Oracle Corporation",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N).",
                  },
               ],
            },
            impact: {
               cvss: {
                  baseScore: "5.3",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N",
                  version: "3.1",
               },
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data.",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://www.oracle.com/security-alerts/cpujul2020.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpujul2020.html",
                  },
                  {
                     name: "https://www.zerodayinitiative.com/advisories/ZDI-20-889/",
                     refsource: "MISC",
                     url: "https://www.zerodayinitiative.com/advisories/ZDI-20-889/",
                  },
                  {
                     name: "openSUSE-SU-2020:1486",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html",
                  },
                  {
                     name: "openSUSE-SU-2020:1511",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html",
                  },
                  {
                     name: "GLSA-202101-09",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/202101-09",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "43595867-4340-4103-b7a2-9a5208d29a85",
      assignerShortName: "oracle",
      cveId: "CVE-2020-14648",
      datePublished: "2020-07-15T17:34:32",
      dateReserved: "2020-06-19T00:00:00",
      dateUpdated: "2024-09-27T18:27:26.934Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2020-14695

Vulnerability from cvelistv5

Published

2020-07-15 17:34

Modified

2024-09-26 20:41

Severity ?

5.3 (Medium) - CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N

Summary

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N).

References

▼	URL	Tags
	https://www.oracle.com/security-alerts/cpujul2020.html	x_refsource_MISC
	https://www.zerodayinitiative.com/advisories/ZDI-20-900/	x_refsource_MISC
	http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html	vendor-advisory, x_refsource_SUSE
	https://security.gentoo.org/glsa/202101-09	vendor-advisory, x_refsource_GENTOO

Impacted products

	Vendor	Product	Version
	Oracle Corporation	VM VirtualBox	Version: unspecified < 5.2.44 Version: unspecified < 6.0.24 Version: unspecified < 6.1.12

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T12:53:42.815Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpujul2020.html",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-20-900/",
               },
               {
                  name: "openSUSE-SU-2020:1486",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html",
               },
               {
                  name: "openSUSE-SU-2020:1511",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html",
               },
               {
                  name: "GLSA-202101-09",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202101-09",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2020-14695",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-09-26T19:46:31.487760Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-09-26T20:41:21.321Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "VM VirtualBox",
               vendor: "Oracle Corporation",
               versions: [
                  {
                     lessThan: "5.2.44",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
                  {
                     lessThan: "6.0.24",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
                  {
                     lessThan: "6.1.12",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N).",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "HIGH",
                  attackVector: "LOCAL",
                  availabilityImpact: "NONE",
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "NONE",
                  privilegesRequired: "HIGH",
                  scope: "CHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data.",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2021-01-12T19:06:44",
            orgId: "43595867-4340-4103-b7a2-9a5208d29a85",
            shortName: "oracle",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpujul2020.html",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.zerodayinitiative.com/advisories/ZDI-20-900/",
            },
            {
               name: "openSUSE-SU-2020:1486",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html",
            },
            {
               name: "openSUSE-SU-2020:1511",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html",
            },
            {
               name: "GLSA-202101-09",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/202101-09",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "secalert_us@oracle.com",
               ID: "CVE-2020-14695",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "VM VirtualBox",
                                 version: {
                                    version_data: [
                                       {
                                          version_affected: "<",
                                          version_value: "5.2.44",
                                       },
                                       {
                                          version_affected: "<",
                                          version_value: "6.0.24",
                                       },
                                       {
                                          version_affected: "<",
                                          version_value: "6.1.12",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "Oracle Corporation",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N).",
                  },
               ],
            },
            impact: {
               cvss: {
                  baseScore: "5.3",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N",
                  version: "3.1",
               },
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data.",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://www.oracle.com/security-alerts/cpujul2020.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpujul2020.html",
                  },
                  {
                     name: "https://www.zerodayinitiative.com/advisories/ZDI-20-900/",
                     refsource: "MISC",
                     url: "https://www.zerodayinitiative.com/advisories/ZDI-20-900/",
                  },
                  {
                     name: "openSUSE-SU-2020:1486",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html",
                  },
                  {
                     name: "openSUSE-SU-2020:1511",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html",
                  },
                  {
                     name: "GLSA-202101-09",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/202101-09",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "43595867-4340-4103-b7a2-9a5208d29a85",
      assignerShortName: "oracle",
      cveId: "CVE-2020-14695",
      datePublished: "2020-07-15T17:34:34",
      dateReserved: "2020-06-19T00:00:00",
      dateUpdated: "2024-09-26T20:41:21.321Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2020-14677

Vulnerability from cvelistv5

Published

2020-07-15 17:34

Modified

2024-09-27 18:23

Severity ?

7.5 (High) - CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Summary

References

▼	URL	Tags
	https://www.oracle.com/security-alerts/cpujul2020.html	x_refsource_MISC
	https://www.zerodayinitiative.com/advisories/ZDI-20-893/	x_refsource_MISC
	http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html	vendor-advisory, x_refsource_SUSE
	https://security.gentoo.org/glsa/202101-09	vendor-advisory, x_refsource_GENTOO

Impacted products

	Vendor	Product	Version
	Oracle Corporation	VM VirtualBox	Version: unspecified < 5.2.44 Version: unspecified < 6.0.24 Version: unspecified < 6.1.12

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T12:53:42.690Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpujul2020.html",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-20-893/",
               },
               {
                  name: "openSUSE-SU-2020:1486",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html",
               },
               {
                  name: "openSUSE-SU-2020:1511",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html",
               },
               {
                  name: "GLSA-202101-09",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202101-09",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2020-14677",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-09-27T17:54:45.993498Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-09-27T18:23:55.362Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "VM VirtualBox",
               vendor: "Oracle Corporation",
               versions: [
                  {
                     lessThan: "5.2.44",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
                  {
                     lessThan: "6.0.24",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
                  {
                     lessThan: "6.1.12",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "HIGH",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "HIGH",
                  scope: "CHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products.  Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox.",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2021-01-12T19:07:24",
            orgId: "43595867-4340-4103-b7a2-9a5208d29a85",
            shortName: "oracle",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpujul2020.html",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.zerodayinitiative.com/advisories/ZDI-20-893/",
            },
            {
               name: "openSUSE-SU-2020:1486",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html",
            },
            {
               name: "openSUSE-SU-2020:1511",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html",
            },
            {
               name: "GLSA-202101-09",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/202101-09",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "secalert_us@oracle.com",
               ID: "CVE-2020-14677",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "VM VirtualBox",
                                 version: {
                                    version_data: [
                                       {
                                          version_affected: "<",
                                          version_value: "5.2.44",
                                       },
                                       {
                                          version_affected: "<",
                                          version_value: "6.0.24",
                                       },
                                       {
                                          version_affected: "<",
                                          version_value: "6.1.12",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "Oracle Corporation",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).",
                  },
               ],
            },
            impact: {
               cvss: {
                  baseScore: "7.5",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
                  version: "3.1",
               },
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products.  Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox.",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://www.oracle.com/security-alerts/cpujul2020.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpujul2020.html",
                  },
                  {
                     name: "https://www.zerodayinitiative.com/advisories/ZDI-20-893/",
                     refsource: "MISC",
                     url: "https://www.zerodayinitiative.com/advisories/ZDI-20-893/",
                  },
                  {
                     name: "openSUSE-SU-2020:1486",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html",
                  },
                  {
                     name: "openSUSE-SU-2020:1511",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html",
                  },
                  {
                     name: "GLSA-202101-09",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/202101-09",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "43595867-4340-4103-b7a2-9a5208d29a85",
      assignerShortName: "oracle",
      cveId: "CVE-2020-14677",
      datePublished: "2020-07-15T17:34:33",
      dateReserved: "2020-06-19T00:00:00",
      dateUpdated: "2024-09-27T18:23:55.362Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2020-14650

Vulnerability from cvelistv5

Published

2020-07-15 17:34

Modified

2024-09-27 18:27

Severity ?

5.3 (Medium) - CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N

Summary

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N).

References

▼	URL	Tags
	https://www.oracle.com/security-alerts/cpujul2020.html	x_refsource_MISC
	https://www.zerodayinitiative.com/advisories/ZDI-20-892/	x_refsource_MISC
	http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html	vendor-advisory, x_refsource_SUSE
	https://security.gentoo.org/glsa/202101-09	vendor-advisory, x_refsource_GENTOO

Impacted products

	Vendor	Product	Version
	Oracle Corporation	VM VirtualBox	Version: unspecified < 5.2.44 Version: unspecified < 6.0.24 Version: unspecified < 6.1.12

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T12:53:42.690Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpujul2020.html",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-20-892/",
               },
               {
                  name: "openSUSE-SU-2020:1486",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html",
               },
               {
                  name: "openSUSE-SU-2020:1511",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html",
               },
               {
                  name: "GLSA-202101-09",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202101-09",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2020-14650",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-09-27T17:57:31.596662Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-09-27T18:27:06.246Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "VM VirtualBox",
               vendor: "Oracle Corporation",
               versions: [
                  {
                     lessThan: "5.2.44",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
                  {
                     lessThan: "6.0.24",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
                  {
                     lessThan: "6.1.12",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N).",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "HIGH",
                  attackVector: "LOCAL",
                  availabilityImpact: "NONE",
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "NONE",
                  privilegesRequired: "HIGH",
                  scope: "CHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data.",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2021-01-12T19:06:49",
            orgId: "43595867-4340-4103-b7a2-9a5208d29a85",
            shortName: "oracle",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpujul2020.html",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.zerodayinitiative.com/advisories/ZDI-20-892/",
            },
            {
               name: "openSUSE-SU-2020:1486",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html",
            },
            {
               name: "openSUSE-SU-2020:1511",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html",
            },
            {
               name: "GLSA-202101-09",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/202101-09",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "secalert_us@oracle.com",
               ID: "CVE-2020-14650",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "VM VirtualBox",
                                 version: {
                                    version_data: [
                                       {
                                          version_affected: "<",
                                          version_value: "5.2.44",
                                       },
                                       {
                                          version_affected: "<",
                                          version_value: "6.0.24",
                                       },
                                       {
                                          version_affected: "<",
                                          version_value: "6.1.12",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "Oracle Corporation",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N).",
                  },
               ],
            },
            impact: {
               cvss: {
                  baseScore: "5.3",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N",
                  version: "3.1",
               },
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data.",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://www.oracle.com/security-alerts/cpujul2020.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpujul2020.html",
                  },
                  {
                     name: "https://www.zerodayinitiative.com/advisories/ZDI-20-892/",
                     refsource: "MISC",
                     url: "https://www.zerodayinitiative.com/advisories/ZDI-20-892/",
                  },
                  {
                     name: "openSUSE-SU-2020:1486",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html",
                  },
                  {
                     name: "openSUSE-SU-2020:1511",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html",
                  },
                  {
                     name: "GLSA-202101-09",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/202101-09",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "43595867-4340-4103-b7a2-9a5208d29a85",
      assignerShortName: "oracle",
      cveId: "CVE-2020-14650",
      datePublished: "2020-07-15T17:34:32",
      dateReserved: "2020-06-19T00:00:00",
      dateUpdated: "2024-09-27T18:27:06.246Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2020-14707

Vulnerability from cvelistv5

Published

2020-07-15 17:34

Modified

2024-09-26 20:39

Severity ?

5.0 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

Summary

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 5.0 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H).

References

▼	URL	Tags
	https://www.oracle.com/security-alerts/cpujul2020.html	x_refsource_MISC
	http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html	vendor-advisory, x_refsource_SUSE
	https://security.gentoo.org/glsa/202101-09	vendor-advisory, x_refsource_GENTOO

Impacted products

	Vendor	Product	Version
	Oracle Corporation	VM VirtualBox	Version: unspecified < 5.2.44 Version: unspecified < 6.0.24 Version: unspecified < 6.1.12

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T12:53:43.238Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpujul2020.html",
               },
               {
                  name: "openSUSE-SU-2020:1486",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html",
               },
               {
                  name: "openSUSE-SU-2020:1511",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html",
               },
               {
                  name: "GLSA-202101-09",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202101-09",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2020-14707",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-09-26T19:46:16.953692Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-09-26T20:39:07.199Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "VM VirtualBox",
               vendor: "Oracle Corporation",
               versions: [
                  {
                     lessThan: "5.2.44",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
                  {
                     lessThan: "6.0.24",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
                  {
                     lessThan: "6.1.12",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 5.0 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H).",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 5,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox.",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2021-01-12T19:06:43",
            orgId: "43595867-4340-4103-b7a2-9a5208d29a85",
            shortName: "oracle",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpujul2020.html",
            },
            {
               name: "openSUSE-SU-2020:1486",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html",
            },
            {
               name: "openSUSE-SU-2020:1511",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html",
            },
            {
               name: "GLSA-202101-09",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/202101-09",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "secalert_us@oracle.com",
               ID: "CVE-2020-14707",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "VM VirtualBox",
                                 version: {
                                    version_data: [
                                       {
                                          version_affected: "<",
                                          version_value: "5.2.44",
                                       },
                                       {
                                          version_affected: "<",
                                          version_value: "6.0.24",
                                       },
                                       {
                                          version_affected: "<",
                                          version_value: "6.1.12",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "Oracle Corporation",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 5.0 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H).",
                  },
               ],
            },
            impact: {
               cvss: {
                  baseScore: "5.0",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox.",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://www.oracle.com/security-alerts/cpujul2020.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpujul2020.html",
                  },
                  {
                     name: "openSUSE-SU-2020:1486",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html",
                  },
                  {
                     name: "openSUSE-SU-2020:1511",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html",
                  },
                  {
                     name: "GLSA-202101-09",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/202101-09",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "43595867-4340-4103-b7a2-9a5208d29a85",
      assignerShortName: "oracle",
      cveId: "CVE-2020-14707",
      datePublished: "2020-07-15T17:34:35",
      dateReserved: "2020-06-19T00:00:00",
      dateUpdated: "2024-09-26T20:39:07.199Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2020-14700

Vulnerability from cvelistv5

Published

2020-07-15 17:34

Modified

2024-09-26 20:40

Severity ?

5.3 (Medium) - CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N

Summary

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N).

References

▼	URL	Tags
	https://www.oracle.com/security-alerts/cpujul2020.html	x_refsource_MISC
	https://www.zerodayinitiative.com/advisories/ZDI-20-903/	x_refsource_MISC
	http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html	vendor-advisory, x_refsource_SUSE
	https://security.gentoo.org/glsa/202101-09	vendor-advisory, x_refsource_GENTOO

Impacted products

	Vendor	Product	Version
	Oracle Corporation	VM VirtualBox	Version: unspecified < 5.2.44 Version: unspecified < 6.0.24 Version: unspecified < 6.1.12

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T12:53:43.160Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpujul2020.html",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-20-903/",
               },
               {
                  name: "openSUSE-SU-2020:1486",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html",
               },
               {
                  name: "openSUSE-SU-2020:1511",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html",
               },
               {
                  name: "GLSA-202101-09",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202101-09",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2020-14700",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-09-26T19:46:26.773293Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-09-26T20:40:24.419Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "VM VirtualBox",
               vendor: "Oracle Corporation",
               versions: [
                  {
                     lessThan: "5.2.44",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
                  {
                     lessThan: "6.0.24",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
                  {
                     lessThan: "6.1.12",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N).",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "HIGH",
                  attackVector: "LOCAL",
                  availabilityImpact: "NONE",
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "NONE",
                  privilegesRequired: "HIGH",
                  scope: "CHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data.",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2021-01-12T19:07:20",
            orgId: "43595867-4340-4103-b7a2-9a5208d29a85",
            shortName: "oracle",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpujul2020.html",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.zerodayinitiative.com/advisories/ZDI-20-903/",
            },
            {
               name: "openSUSE-SU-2020:1486",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html",
            },
            {
               name: "openSUSE-SU-2020:1511",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html",
            },
            {
               name: "GLSA-202101-09",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/202101-09",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "secalert_us@oracle.com",
               ID: "CVE-2020-14700",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "VM VirtualBox",
                                 version: {
                                    version_data: [
                                       {
                                          version_affected: "<",
                                          version_value: "5.2.44",
                                       },
                                       {
                                          version_affected: "<",
                                          version_value: "6.0.24",
                                       },
                                       {
                                          version_affected: "<",
                                          version_value: "6.1.12",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "Oracle Corporation",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N).",
                  },
               ],
            },
            impact: {
               cvss: {
                  baseScore: "5.3",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N",
                  version: "3.1",
               },
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data.",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://www.oracle.com/security-alerts/cpujul2020.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpujul2020.html",
                  },
                  {
                     name: "https://www.zerodayinitiative.com/advisories/ZDI-20-903/",
                     refsource: "MISC",
                     url: "https://www.zerodayinitiative.com/advisories/ZDI-20-903/",
                  },
                  {
                     name: "openSUSE-SU-2020:1486",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html",
                  },
                  {
                     name: "openSUSE-SU-2020:1511",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html",
                  },
                  {
                     name: "GLSA-202101-09",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/202101-09",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "43595867-4340-4103-b7a2-9a5208d29a85",
      assignerShortName: "oracle",
      cveId: "CVE-2020-14700",
      datePublished: "2020-07-15T17:34:34",
      dateReserved: "2020-06-19T00:00:00",
      dateUpdated: "2024-09-26T20:40:24.419Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2020-14713

Vulnerability from cvelistv5

Published

2020-07-15 17:34

Modified

2024-09-26 20:37

Severity ?

7.5 (High) - CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Summary

References

▼	URL	Tags
	https://www.oracle.com/security-alerts/cpujul2020.html	x_refsource_MISC
	http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html	vendor-advisory, x_refsource_SUSE
	https://security.gentoo.org/glsa/202101-09	vendor-advisory, x_refsource_GENTOO

Impacted products

	Vendor	Product	Version
	Oracle Corporation	VM VirtualBox	Version: unspecified < 5.2.44 Version: unspecified < 6.0.24 Version: unspecified < 6.1.12

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T12:53:43.345Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpujul2020.html",
               },
               {
                  name: "openSUSE-SU-2020:1486",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html",
               },
               {
                  name: "openSUSE-SU-2020:1511",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html",
               },
               {
                  name: "GLSA-202101-09",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202101-09",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2020-14713",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-09-26T19:54:19.832376Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-09-26T20:37:49.080Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "VM VirtualBox",
               vendor: "Oracle Corporation",
               versions: [
                  {
                     lessThan: "5.2.44",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
                  {
                     lessThan: "6.0.24",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
                  {
                     lessThan: "6.1.12",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "HIGH",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "HIGH",
                  scope: "CHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products.  Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox.",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2021-01-12T19:07:21",
            orgId: "43595867-4340-4103-b7a2-9a5208d29a85",
            shortName: "oracle",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpujul2020.html",
            },
            {
               name: "openSUSE-SU-2020:1486",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html",
            },
            {
               name: "openSUSE-SU-2020:1511",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html",
            },
            {
               name: "GLSA-202101-09",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/202101-09",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "secalert_us@oracle.com",
               ID: "CVE-2020-14713",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "VM VirtualBox",
                                 version: {
                                    version_data: [
                                       {
                                          version_affected: "<",
                                          version_value: "5.2.44",
                                       },
                                       {
                                          version_affected: "<",
                                          version_value: "6.0.24",
                                       },
                                       {
                                          version_affected: "<",
                                          version_value: "6.1.12",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "Oracle Corporation",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).",
                  },
               ],
            },
            impact: {
               cvss: {
                  baseScore: "7.5",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
                  version: "3.1",
               },
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products.  Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox.",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://www.oracle.com/security-alerts/cpujul2020.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpujul2020.html",
                  },
                  {
                     name: "openSUSE-SU-2020:1486",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html",
                  },
                  {
                     name: "openSUSE-SU-2020:1511",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html",
                  },
                  {
                     name: "GLSA-202101-09",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/202101-09",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "43595867-4340-4103-b7a2-9a5208d29a85",
      assignerShortName: "oracle",
      cveId: "CVE-2020-14713",
      datePublished: "2020-07-15T17:34:35",
      dateReserved: "2020-06-19T00:00:00",
      dateUpdated: "2024-09-26T20:37:49.080Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2020-14675

Vulnerability from cvelistv5

Published

2020-07-15 17:34

Modified

2024-09-27 18:24

Severity ?

7.5 (High) - CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Summary

References

▼	URL	Tags
	https://www.oracle.com/security-alerts/cpujul2020.html	x_refsource_MISC
	https://www.zerodayinitiative.com/advisories/ZDI-20-895/	x_refsource_MISC
	http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html	vendor-advisory, x_refsource_SUSE
	https://security.gentoo.org/glsa/202101-09	vendor-advisory, x_refsource_GENTOO

Impacted products

	Vendor	Product	Version
	Oracle Corporation	VM VirtualBox	Version: unspecified < 5.2.44 Version: unspecified < 6.0.24 Version: unspecified < 6.1.12

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T12:53:42.603Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpujul2020.html",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-20-895/",
               },
               {
                  name: "openSUSE-SU-2020:1486",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html",
               },
               {
                  name: "openSUSE-SU-2020:1511",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html",
               },
               {
                  name: "GLSA-202101-09",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202101-09",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2020-14675",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-09-27T17:54:48.519931Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-09-27T18:24:17.693Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "VM VirtualBox",
               vendor: "Oracle Corporation",
               versions: [
                  {
                     lessThan: "5.2.44",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
                  {
                     lessThan: "6.0.24",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
                  {
                     lessThan: "6.1.12",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "HIGH",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "HIGH",
                  scope: "CHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products.  Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox.",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2021-01-12T19:06:40",
            orgId: "43595867-4340-4103-b7a2-9a5208d29a85",
            shortName: "oracle",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpujul2020.html",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.zerodayinitiative.com/advisories/ZDI-20-895/",
            },
            {
               name: "openSUSE-SU-2020:1486",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html",
            },
            {
               name: "openSUSE-SU-2020:1511",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html",
            },
            {
               name: "GLSA-202101-09",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/202101-09",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "secalert_us@oracle.com",
               ID: "CVE-2020-14675",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "VM VirtualBox",
                                 version: {
                                    version_data: [
                                       {
                                          version_affected: "<",
                                          version_value: "5.2.44",
                                       },
                                       {
                                          version_affected: "<",
                                          version_value: "6.0.24",
                                       },
                                       {
                                          version_affected: "<",
                                          version_value: "6.1.12",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "Oracle Corporation",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).",
                  },
               ],
            },
            impact: {
               cvss: {
                  baseScore: "7.5",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
                  version: "3.1",
               },
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products.  Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox.",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://www.oracle.com/security-alerts/cpujul2020.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpujul2020.html",
                  },
                  {
                     name: "https://www.zerodayinitiative.com/advisories/ZDI-20-895/",
                     refsource: "MISC",
                     url: "https://www.zerodayinitiative.com/advisories/ZDI-20-895/",
                  },
                  {
                     name: "openSUSE-SU-2020:1486",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html",
                  },
                  {
                     name: "openSUSE-SU-2020:1511",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html",
                  },
                  {
                     name: "GLSA-202101-09",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/202101-09",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "43595867-4340-4103-b7a2-9a5208d29a85",
      assignerShortName: "oracle",
      cveId: "CVE-2020-14675",
      datePublished: "2020-07-15T17:34:33",
      dateReserved: "2020-06-19T00:00:00",
      dateUpdated: "2024-09-27T18:24:17.693Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2020-14714

Vulnerability from cvelistv5

Published

2020-07-15 17:34

Modified

2024-09-26 20:37

Severity ?

4.4 (Medium) - CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Summary

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

References

▼	URL	Tags
	https://www.oracle.com/security-alerts/cpujul2020.html	x_refsource_MISC
	http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html	vendor-advisory, x_refsource_SUSE
	https://security.gentoo.org/glsa/202101-09	vendor-advisory, x_refsource_GENTOO

Impacted products

	Vendor	Product	Version
	Oracle Corporation	VM VirtualBox	Version: unspecified < 5.2.44 Version: unspecified < 6.0.24 Version: unspecified < 6.1.12

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T12:53:43.229Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpujul2020.html",
               },
               {
                  name: "openSUSE-SU-2020:1486",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html",
               },
               {
                  name: "openSUSE-SU-2020:1511",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html",
               },
               {
                  name: "GLSA-202101-09",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202101-09",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2020-14714",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-09-26T19:46:09.638946Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-09-26T20:37:34.199Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "VM VirtualBox",
               vendor: "Oracle Corporation",
               versions: [
                  {
                     lessThan: "5.2.44",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
                  {
                     lessThan: "6.0.24",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
                  {
                     lessThan: "6.1.12",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 4.4,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "HIGH",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox.",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2021-01-12T19:07:11",
            orgId: "43595867-4340-4103-b7a2-9a5208d29a85",
            shortName: "oracle",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpujul2020.html",
            },
            {
               name: "openSUSE-SU-2020:1486",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html",
            },
            {
               name: "openSUSE-SU-2020:1511",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html",
            },
            {
               name: "GLSA-202101-09",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/202101-09",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "secalert_us@oracle.com",
               ID: "CVE-2020-14714",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "VM VirtualBox",
                                 version: {
                                    version_data: [
                                       {
                                          version_affected: "<",
                                          version_value: "5.2.44",
                                       },
                                       {
                                          version_affected: "<",
                                          version_value: "6.0.24",
                                       },
                                       {
                                          version_affected: "<",
                                          version_value: "6.1.12",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "Oracle Corporation",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).",
                  },
               ],
            },
            impact: {
               cvss: {
                  baseScore: "4.4",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox.",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://www.oracle.com/security-alerts/cpujul2020.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpujul2020.html",
                  },
                  {
                     name: "openSUSE-SU-2020:1486",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html",
                  },
                  {
                     name: "openSUSE-SU-2020:1511",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html",
                  },
                  {
                     name: "GLSA-202101-09",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/202101-09",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "43595867-4340-4103-b7a2-9a5208d29a85",
      assignerShortName: "oracle",
      cveId: "CVE-2020-14714",
      datePublished: "2020-07-15T17:34:35",
      dateReserved: "2020-06-19T00:00:00",
      dateUpdated: "2024-09-26T20:37:34.199Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2020-14698

Vulnerability from cvelistv5

Published

2020-07-15 17:34

Modified

2024-09-26 20:40

Severity ?

5.3 (Medium) - CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N

Summary

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N).

References

▼	URL	Tags
	https://www.oracle.com/security-alerts/cpujul2020.html	x_refsource_MISC
	https://www.zerodayinitiative.com/advisories/ZDI-20-901/	x_refsource_MISC
	http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html	vendor-advisory, x_refsource_SUSE
	https://security.gentoo.org/glsa/202101-09	vendor-advisory, x_refsource_GENTOO

Impacted products

	Vendor	Product	Version
	Oracle Corporation	VM VirtualBox	Version: unspecified < 5.2.44 Version: unspecified < 6.0.24 Version: unspecified < 6.1.12

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T12:53:43.154Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpujul2020.html",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-20-901/",
               },
               {
                  name: "openSUSE-SU-2020:1486",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html",
               },
               {
                  name: "openSUSE-SU-2020:1511",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html",
               },
               {
                  name: "GLSA-202101-09",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202101-09",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2020-14698",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-09-26T19:46:29.759524Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-09-26T20:40:46.825Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "VM VirtualBox",
               vendor: "Oracle Corporation",
               versions: [
                  {
                     lessThan: "5.2.44",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
                  {
                     lessThan: "6.0.24",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
                  {
                     lessThan: "6.1.12",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N).",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "HIGH",
                  attackVector: "LOCAL",
                  availabilityImpact: "NONE",
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "NONE",
                  privilegesRequired: "HIGH",
                  scope: "CHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data.",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2021-01-12T19:06:46",
            orgId: "43595867-4340-4103-b7a2-9a5208d29a85",
            shortName: "oracle",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpujul2020.html",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.zerodayinitiative.com/advisories/ZDI-20-901/",
            },
            {
               name: "openSUSE-SU-2020:1486",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html",
            },
            {
               name: "openSUSE-SU-2020:1511",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html",
            },
            {
               name: "GLSA-202101-09",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/202101-09",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "secalert_us@oracle.com",
               ID: "CVE-2020-14698",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "VM VirtualBox",
                                 version: {
                                    version_data: [
                                       {
                                          version_affected: "<",
                                          version_value: "5.2.44",
                                       },
                                       {
                                          version_affected: "<",
                                          version_value: "6.0.24",
                                       },
                                       {
                                          version_affected: "<",
                                          version_value: "6.1.12",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "Oracle Corporation",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N).",
                  },
               ],
            },
            impact: {
               cvss: {
                  baseScore: "5.3",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N",
                  version: "3.1",
               },
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data.",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://www.oracle.com/security-alerts/cpujul2020.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpujul2020.html",
                  },
                  {
                     name: "https://www.zerodayinitiative.com/advisories/ZDI-20-901/",
                     refsource: "MISC",
                     url: "https://www.zerodayinitiative.com/advisories/ZDI-20-901/",
                  },
                  {
                     name: "openSUSE-SU-2020:1486",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00068.html",
                  },
                  {
                     name: "openSUSE-SU-2020:1511",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00079.html",
                  },
                  {
                     name: "GLSA-202101-09",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/202101-09",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "43595867-4340-4103-b7a2-9a5208d29a85",
      assignerShortName: "oracle",
      cveId: "CVE-2020-14698",
      datePublished: "2020-07-15T17:34:34",
      dateReserved: "2020-06-19T00:00:00",
      dateUpdated: "2024-09-26T20:40:46.825Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

Vulnerability from csaf_opensuse

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature