CVE-2019-2690
Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core)...
Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.2.28 and prior to 6.0.6. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.2.28 and prior to 6.0.6. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).
- Record
CVE-2019-2690- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H - CVSS 2.0
- 4.4 Medium
AV:L/AC:M/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.2.28 and prior to 6.0.6. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).
- Record
CVE-2019-2690- Updated
- 2026-11-02
EUVDEUVD-2019-12330 No score
Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.2.28 and prior to 6.0.6. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).
- Record
EUVD-2019-12330- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9mpm-cpqp-766f No score
Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core)...
Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.2.28 and prior to 6.0.6. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).
- Record
GHSA-9mpm-cpqp-766f- Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-2690
Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.2.28 and prior to 6.0.6. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).
- Record
UBUNTU-CVE-2019-2690- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2019-0151 No score
Virtualbox 6.0.6 fixes security vulnerabilities
This update provides an update to the new Virtualbox 6.0 branch, currently 6.0.6. It also fixes the following security issues.
Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data (CVE-2019-2574).
Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox (CVE-2019-2656, CVE-2019-2657, CVE-2019-2680, CVE-2019-2696, CVE-2019-2703, CVE-2019-2721, CVE-2019-2722, CVE-2019-2723
Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data (CVE-2019-2678).
Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox and unauthorized read access to a subset of Oracle VM VirtualBox accessible data (CVE-2019-2679).
Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox (CVE-2019-2690).
For info about other changes in this update, see the referenced changelog.
- Record
MGASA-2019-0151- Updated
- 2026-11-02
OSVopenSUSE-SU-2019:1814-1 No score
Security update for virtualbox
This update for virtualbox to version 6.0.10 fixes the following issues:
Security issues fixed:
- CVE-2019-2859 CVE-2019-2867 CVE-2019-2866 CVE-2019-2864 CVE-2019-2865 CVE-2019-1543 CVE-2019-2863 CVE-2019-2848 CVE-2019-2877 CVE-2019-2873 CVE-2019-2874 CVE-2019-2875 CVE-2019-2876 CVE-2019-2850 (boo#1141801)
- Record
openSUSE-SU-2019:1814-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
kmod-vboxadditionsMageia:6 From an advisory covering 12 CVEs |
before 6.0.6-1.mga6 | 6.0.6-1.mga6 |
kmod-virtualboxMageia:6 From an advisory covering 12 CVEs |
before 6.0.6-1.mga6 | 6.0.6-1.mga6 |
virtualboxMageia:6 From an advisory covering 12 CVEs |
before 6.0.6-1.mga6 | 6.0.6-1.mga6 |
virtualboxUbuntu:16.04:LTS |
All versions, plus listed versions 5.0.4-dfsg-25.0.8-dfsg-15.0.10-dfsg-15.0.10-dfsg-25.0.10-dfsg-3 Show 25 moreShow less5.0.10-dfsg-45.0.10-dfsg-55.0.10-dfsg-65.0.10-dfsg-75.0.12-dfsg-15.0.12-dfsg-25.0.14-dfsg-15.0.14-dfsg-25.0.14-dfsg-2build15.0.16-dfsg-25.0.16-dfsg-35.0.18-dfsg-15.0.18-dfsg-1ubuntu15.0.18-dfsg-25.0.18-dfsg-2build15.0.18-dfsg-2ubuntu15.0.24-dfsg-0ubuntu1.16.04.15.0.32-dfsg-0ubuntu1.16.04.25.0.36-dfsg-0ubuntu1.16.04.25.0.40-dfsg-0ubuntu1.16.04.15.0.40-dfsg-0ubuntu1.16.04.25.1.34-dfsg-0ubuntu1.16.04.25.1.38-dfsg-0ubuntu1.16.04.15.1.38-dfsg-0ubuntu1.16.04.25.1.38-dfsg-0ubuntu1.16.04.3 |
None known |
virtualboxUbuntu:18.04:LTS |
All versions, plus listed versions 5.1.30-dfsg-15.2.0-dfsg-1build25.2.0-dfsg-25.2.0-dfsg-45.2.0-dfsg-5 Show 26 moreShow less5.2.2-dfsg-25.2.2-dfsg-3~build15.2.2-dfsg-35.2.4-dfsg-15.2.4-dfsg-25.2.6-dfsg-15.2.6-dfsg-25.2.6-dfsg-35.2.6-dfsg-3build15.2.6-dfsg-55.2.8-dfsg-25.2.8-dfsg-35.2.8-dfsg-55.2.8-dfsg-65.2.8-dfsg-75.2.10-dfsg-15.2.10-dfsg-25.2.10-dfsg-55.2.10-dfsg-65.2.10-dfsg-6ubuntu18.04.15.2.18-dfsg-2~ubuntu18.04.15.2.18-dfsg-2~ubuntu18.04.35.2.18-dfsg-2~ubuntu18.04.55.2.32-dfsg-0~ubuntu18.04.15.2.34-dfsg-0~ubuntu18.04.15.2.42-dfsg-0~ubuntu1.18.04.1 |
None known |
virtualboxopenSUSE:Leap 15.0 From an advisory covering 52 CVEs |
before 6.0.10-lp151.2.6.1 | 6.0.10-lp151.2.6.1 |
virtualboxopenSUSE:Leap 15.1 From an advisory covering 52 CVEs |
before 6.0.10-lp151.2.6.1 | 6.0.10-lp151.2.6.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-2690 is a high vulnerability (CVSS 7.8) in Oracle Vm Virtualbox, published April 23, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.48%, the 42nd percentile. No source names a fixed version.
References
oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
lists.opensuse.org/opensuse-security-announce/2019-07/msg00056.html
nvd.nist.gov/vuln/detail/CVE-2019-2690
github.com/advisories/GHSA-9mpm-cpqp-766f
advisories.mageia.org/MGASA-2019-0151.html
bugs.mageia.org/show_bug.cgi?id=24683
Show 70 moreShow less
virtualbox.org/wiki/Changelog-6.0
ubuntu.com/security/CVE-2019-2690
cve.org/CVERecord?id=CVE-2019-2690
bugzilla.suse.com/1097248
suse.com/security/cve/CVE-2018-0734