CVE-2014-0405
Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization...
Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 3.2.20, 4.0.22, 4.1.30, 4.2.20, and 4.3.4 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Core, a different vulnerability than CVE-2014-0407.
Exploit likelihood
What each source reports
NVD Score used
Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 3.2.20, 4.0.22, 4.1.30, 4.2.20, and 4.3.4 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Core, a different vulnerability than CVE-2014-0407.
- Record
CVE-2014-0405- CVSS 2.0
- 3.5 Low
AV:L/AC:H/Au:S/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 3.2.20, 4.0.22, 4.1.30, 4.2.20, and 4.3.4 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Core, a different vulnerability than CVE-2014-0407.
- Record
CVE-2014-0405- Updated
- 2026-11-02
EUVDEUVD-2014-0443 No score
Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 3.2.20, 4.0.22, 4.1.30, 4.2.20, and 4.3.4 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Core, a different vulnerability than CVE-2014-0407.
- Record
EUVD-2014-0443- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-247g-7x8j-8cc8 No score
Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization...
Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 3.2.20, 4.0.22, 4.1.30, 4.2.20, and 4.3.4 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Core, a different vulnerability than CVE-2014-0407.
- Record
GHSA-247g-7x8j-8cc8- Updated
- 2026-11-02
OSV No score
Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 3.2.20, 4.0.22, 4.1.30, 4.2.20, and 4.3.4 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Core, a different vulnerability than CVE-2014-0407.
- Record
CVE-2014-0405- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-0405 No score
Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 3.2.20, 4.0.22, 4.1.30, 4.2.20, and 4.3.4 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Core, a different vulnerability than CVE-2014-0407.
- Record
DEBIAN-CVE-2014-0405- Updated
- 2026-11-02
OSVMGASA-2014-0184 No score
Updated virtualbox packages fixes security vulnerabilities
Multiple vulnerabilities in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 3.2.20, 4.0.22, 4.1.30, 4.2.20, and 4.3.4 allows local users to affect integrity and availability via unknown vectors related to Core (CVE-2013-5892, CVE-2014-0404, CVE-2014-0405, CVE-2014-0406, CVE-2014-0407).
VBox/GuestHost/OpenGL/util/net.c in Oracle VirtualBox before 3.2.22, 4.0.x before 4.0.24, 4.1.x before 4.1.32, 4.2.x before 4.2.24, and 4.3.x before 4.3.8, when using 3D Acceleration allows local guest OS users to execute arbitrary code on the Chromium server via crafted Chromium network pointer in a CR_MESSAGE_READBACK or CR_MESSAGE_WRITEBACK message to the VBoxSharedCrOpenGL service, which triggers an arbitrary pointer dereference and memory corruption (CVE-2014-0981).
Multiple array index errors in programs that are automatically generated by VBox/HostServices/SharedOpenGL/crserverlib/server_dispatch.py in Oracle VirtualBox 4.2.x through 4.2.20 and 4.3.x before 4.3.8, when using 3D Acceleration, allow local guest OS users to execute arbitrary code on the Chromium server via certain CR_MESSAGE_OPCODES messages with a crafted index, which are not properly handled (CVE-2014-0983).
The virtualbox packages has been updated to 4.3.10 maintenance release that resolves theese issues and other upstream reported issues (for more info check the referenced changelog).
This update also resolves the following:
- load virtualbox modules on install (mga#8826)
- missing GUI translations (mga#12578)
- Record
MGASA-2014-0184- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-0405 No score
Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 3.2.20, 4.0.22, 4.1.30, 4.2.20, and 4.3.4 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Core, a different vulnerability than CVE-2014-0407.
- Record
UBUNTU-CVE-2014-0405- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
virtualbox-guest-additions-isoDebian:12 |
before 4.3.10-1, plus listed versions 4.0.10-14.0.8-14.1.0-14.1.10-14.1.12-1 Show 18 moreShow less4.1.14-14.1.16-14.1.18-14.1.2-14.1.4-14.1.6-14.1.8-14.2.10-14.2.10-24.2.10-2~bpo70+14.2.16-14.2.16-1~bpo70+14.2.8-14.3.10-1~bpo70+14.3.2-14.3.6-14.3.8-14.3.8-1~bpo70+1 |
4.3.10-1 |
virtualbox-guest-additions-isoDebian:13 |
before 4.3.10-1, plus listed versions 4.0.10-14.0.8-14.1.0-14.1.10-14.1.12-1 Show 18 moreShow less4.1.14-14.1.16-14.1.18-14.1.2-14.1.4-14.1.6-14.1.8-14.2.10-14.2.10-24.2.10-2~bpo70+14.2.16-14.2.16-1~bpo70+14.2.8-14.3.10-1~bpo70+14.3.2-14.3.6-14.3.8-14.3.8-1~bpo70+1 |
4.3.10-1 |
virtualbox-guest-additions-isoDebian:14 |
before 4.3.10-1, plus listed versions 4.0.10-14.0.8-14.1.0-14.1.10-14.1.12-1 Show 18 moreShow less4.1.14-14.1.16-14.1.18-14.1.2-14.1.4-14.1.6-14.1.8-14.2.10-14.2.10-24.2.10-2~bpo70+14.2.16-14.2.16-1~bpo70+14.2.8-14.3.10-1~bpo70+14.3.2-14.3.6-14.3.8-14.3.8-1~bpo70+1 |
4.3.10-1 |
kmod-vboxadditionsMageia:3 From an advisory covering 7 CVEs |
before 4.3.10-1.mga3 | 4.3.10-1.mga3 |
kmod-virtualboxMageia:3 From an advisory covering 7 CVEs |
before 4.3.10-1.mga3 | 4.3.10-1.mga3 |
virtualboxMageia:3 From an advisory covering 7 CVEs |
before 4.3.10-1.mga3 | 4.3.10-1.mga3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-0405 is a low vulnerability (CVSS 3.5) in Oracle Vm Virtualbox, published January 15, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.31%, the 23rd percentile. Fixed in virtualbox-guest-additions-iso 4.3.10-1.
References
osvdb.org/102059
secunia.com/advisories/56490
exchange.xforce.ibmcloud.com/vulnerabilities/90370
securityfocus.com/bid/64900
oracle.com/technetwork/topics/security/cpujan2014-1972949.html
Show 12 moreShow less
securitytracker.com/id/1029610
nvd.nist.gov/vuln/detail/CVE-2014-0405
github.com/advisories/GHSA-247g-7x8j-8cc8
security-tracker.debian.org/tracker/CVE-2014-0405
advisories.mageia.org/MGASA-2014-0184.html
bugs.mageia.org/show_bug.cgi?id=12384
lwn.net/Vulnerabilities/581307
security.gentoo.org/glsa/glsa-201401-13.xml
ubuntu.com/security/CVE-2014-0405
cve.org/CVERecord?id=CVE-2014-0405