CVE-2014-0404
Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization...
Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 3.2.20, 4.0.22, 4.1.30, 4.2.20, and 4.3.4 allows local users to affect integrity and availability via unknown vectors related to Core, a different vulnerability than CVE-2014-0406.
Exploit likelihood
What each source reports
NVD Score used
Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 3.2.20, 4.0.22, 4.1.30, 4.2.20, and 4.3.4 allows local users to affect integrity and availability via unknown vectors related to Core, a different vulnerability than CVE-2014-0406.
- Record
CVE-2014-0404- CVSS 2.0
- 2.4 Low
AV:L/AC:H/Au:S/C:N/I:P/A:P - Updated
- 2026-11-02
CVE List No score
Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 3.2.20, 4.0.22, 4.1.30, 4.2.20, and 4.3.4 allows local users to affect integrity and availability via unknown vectors related to Core, a different vulnerability than CVE-2014-0406.
- Record
CVE-2014-0404- Updated
- 2026-11-02
EUVDEUVD-2014-0442 No score
Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 3.2.20, 4.0.22, 4.1.30, 4.2.20, and 4.3.4 allows local users to affect integrity and availability via unknown vectors related to Core, a different vulnerability than CVE-2014-0406.
- Record
EUVD-2014-0442- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8fcx-r9xq-4pmj No score
Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization...
Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 3.2.20, 4.0.22, 4.1.30, 4.2.20, and 4.3.4 allows local users to affect integrity and availability via unknown vectors related to Core, a different vulnerability than CVE-2014-0406.
- Record
GHSA-8fcx-r9xq-4pmj- Updated
- 2026-11-02
OSVMGASA-2014-0184 No score
Updated virtualbox packages fixes security vulnerabilities
Multiple vulnerabilities in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 3.2.20, 4.0.22, 4.1.30, 4.2.20, and 4.3.4 allows local users to affect integrity and availability via unknown vectors related to Core (CVE-2013-5892, CVE-2014-0404, CVE-2014-0405, CVE-2014-0406, CVE-2014-0407).
VBox/GuestHost/OpenGL/util/net.c in Oracle VirtualBox before 3.2.22, 4.0.x before 4.0.24, 4.1.x before 4.1.32, 4.2.x before 4.2.24, and 4.3.x before 4.3.8, when using 3D Acceleration allows local guest OS users to execute arbitrary code on the Chromium server via crafted Chromium network pointer in a CR_MESSAGE_READBACK or CR_MESSAGE_WRITEBACK message to the VBoxSharedCrOpenGL service, which triggers an arbitrary pointer dereference and memory corruption (CVE-2014-0981).
Multiple array index errors in programs that are automatically generated by VBox/HostServices/SharedOpenGL/crserverlib/server_dispatch.py in Oracle VirtualBox 4.2.x through 4.2.20 and 4.3.x before 4.3.8, when using 3D Acceleration, allow local guest OS users to execute arbitrary code on the Chromium server via certain CR_MESSAGE_OPCODES messages with a crafted index, which are not properly handled (CVE-2014-0983).
The virtualbox packages has been updated to 4.3.10 maintenance release that resolves theese issues and other upstream reported issues (for more info check the referenced changelog).
This update also resolves the following:
- load virtualbox modules on install (mga#8826)
- missing GUI translations (mga#12578)
- Record
MGASA-2014-0184- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-0404 No score
Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 3.2.20, 4.0.22, 4.1.30, 4.2.20, and 4.3.4 allows local users to affect integrity and availability via unknown vectors related to Core, a different vulnerability than CVE-2014-0406.
- Record
UBUNTU-CVE-2014-0404- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
virtualbox-oseDebian:6.0 From an advisory covering 4 CVEs |
before 3.2.10-dfsg-1+squeeze2, plus listed versions 3.2.10-dfsg-13.2.10-dfsg-1+squeeze1 |
3.2.10-dfsg-1+squeeze2 |
virtualboxDebian:7 From an advisory covering 4 CVEs |
before 4.1.18-dfsg-2+deb7u2, plus listed versions 4.1.18-dfsg-2+deb7u1 |
4.1.18-dfsg-2+deb7u2 |
kmod-vboxadditionsMageia:3 From an advisory covering 7 CVEs |
before 4.3.10-1.mga3 | 4.3.10-1.mga3 |
kmod-virtualboxMageia:3 From an advisory covering 7 CVEs |
before 4.3.10-1.mga3 | 4.3.10-1.mga3 |
virtualboxMageia:3 From an advisory covering 7 CVEs |
before 4.3.10-1.mga3 | 4.3.10-1.mga3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-0404 is a low vulnerability (CVSS 2.4) in Oracle Vm Virtualbox, published January 15, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.30%, the 23rd percentile. No source names a fixed version.
References
secunia.com/advisories/56490
debian.org/security/2014/dsa-2878
securityfocus.com/bid/64911
exchange.xforce.ibmcloud.com/vulnerabilities/90372
osvdb.org/102061
Show 12 moreShow less
oracle.com/technetwork/topics/security/cpujan2014-1972949.html
securitytracker.com/id/1029610
nvd.nist.gov/vuln/detail/CVE-2014-0404
github.com/advisories/GHSA-8fcx-r9xq-4pmj
advisories.mageia.org/MGASA-2014-0184.html
bugs.mageia.org/show_bug.cgi?id=12384
lwn.net/Vulnerabilities/581307
security.gentoo.org/glsa/glsa-201401-13.xml
ubuntu.com/security/CVE-2014-0404
cve.org/CVERecord?id=CVE-2014-0404