CVE-2014-0406
Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization...
CVE-2014-0406 is a low vulnerability (CVSS 2.4) in Oracle Vm Virtualbox, published January 15, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.30%, the 23rd percentile. No source names a fixed version.
- Severity
- 2.4 LowCVSS 2.0, NVD
- Exploit chance
- 0.30%EPSS, 23rd percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 3.2.20, 4.0.22, 4.1.30, 4.2.20, and 4.3.4 allows local users to affect integrity and availability via unknown vectors related to Core, a different vulnerability than CVE-2014-0404.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
virtualbox-oseDebian:6.0 From an advisory covering 4 CVEs | before 3.2.10-dfsg-1+squeeze2, plus listed versions 3.2.10-dfsg-13.2.10-dfsg-1+squeeze1 | 3.2.10-dfsg-1+squeeze2 |
virtualboxDebian:7 From an advisory covering 4 CVEs | before 4.1.18-dfsg-2+deb7u2, plus listed versions 4.1.18-dfsg-2+deb7u1 | 4.1.18-dfsg-2+deb7u2 |
kmod-vboxadditionsMageia:3 From an advisory covering 7 CVEs | before 4.3.10-1.mga3 | 4.3.10-1.mga3 |
kmod-virtualboxMageia:3 From an advisory covering 7 CVEs | before 4.3.10-1.mga3 | 4.3.10-1.mga3 |
virtualboxMageia:3 From an advisory covering 7 CVEs | before 4.3.10-1.mga3 | 4.3.10-1.mga3 |
What each source reports
NVD Score used
Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 3.2.20, 4.0.22, 4.1.30, 4.2.20, and 4.3.4 allows local users to affect integrity and availability via unknown vectors related to Core, a different vulnerability than CVE-2014-0404.
- Record
CVE-2014-0406- CVSS 2.0
- 2.4 Low
AV:L/AC:H/Au:S/C:N/I:P/A:P - Updated
- 2026-11-02
CVE ListNo score
Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 3.2.20, 4.0.22, 4.1.30, 4.2.20, and 4.3.4 allows local users to affect integrity and availability via unknown vectors related to Core, a different vulnerability than CVE-2014-0404.
- Record
CVE-2014-0406- Updated
- 2026-11-02
EUVDEUVD-2014-0444No score
Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 3.2.20, 4.0.22, 4.1.30, 4.2.20, and 4.3.4 allows local users to affect integrity and availability via unknown vectors related to Core, a different vulnerability than CVE-2014-0404.
- Record
EUVD-2014-0444- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6335-fw93-q4gjNo score
Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization...
Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 3.2.20, 4.0.22, 4.1.30, 4.2.20, and 4.3.4 allows local users to affect integrity and availability via unknown vectors related to Core, a different vulnerability than CVE-2014-0404.
- Record
GHSA-6335-fw93-q4gj- Updated
- 2026-11-02
OSVMGASA-2014-0184No score
Updated virtualbox packages fixes security vulnerabilities
Multiple vulnerabilities in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 3.2.20, 4.0.22, 4.1.30, 4.2.20, and 4.3.4 allows local users to affect integrity and availability via unknown vectors related to Core (CVE-2013-5892, CVE-2014-0404, CVE-2014-0405, CVE-2014-0406, CVE-2014-0407).
VBox/GuestHost/OpenGL/util/net.c in Oracle VirtualBox before 3.2.22, 4.0.x before 4.0.24, 4.1.x before 4.1.32, 4.2.x before 4.2.24, and 4.3.x before 4.3.8, when using 3D Acceleration allows local guest OS users to execute arbitrary code on the Chromium server via crafted Chromium network pointer in a CR_MESSAGE_READBACK or CR_MESSAGE_WRITEBACK message to the VBoxSharedCrOpenGL service, which triggers an arbitrary pointer dereference and memory corruption (CVE-2014-0981).
Multiple array index errors in programs that are automatically generated by VBox/HostServices/SharedOpenGL/crserverlib/server_dispatch.py in Oracle VirtualBox 4.2.x through 4.2.20 and 4.3.x before 4.3.8, when using 3D Acceleration, allow local guest OS users to execute arbitrary code on the Chromium server via certain CR_MESSAGE_OPCODES messages with a crafted index, which are not properly handled (CVE-2014-0983).
The virtualbox packages has been updated to 4.3.10 maintenance release that resolves theese issues and other upstream reported issues (for more info check the referenced changelog).
This update also resolves the following:
- load virtualbox modules on install (mga#8826)
- missing GUI translations (mga#12578)
- Record
MGASA-2014-0184- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-0406No score
Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 3.2.20, 4.0.22, 4.1.30, 4.2.20, and 4.3.4 allows local users to affect integrity and availability via unknown vectors related to Core, a different vulnerability than CVE-2014-0404.
- Record
UBUNTU-CVE-2014-0406- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
exchange.xforce.ibmcloud.com/vulnerabilities/90371
secunia.com/advisories/56490
osvdb.org/102060
securityfocus.com/bid/64905
debian.org/security/2014/dsa-2878
Show 12 moreShow less
oracle.com/technetwork/topics/security/cpujan2014-1972949.html
securitytracker.com/id/1029610
nvd.nist.gov/vuln/detail/CVE-2014-0406
github.com/advisories/GHSA-6335-fw93-q4gj
advisories.mageia.org/MGASA-2014-0184.html
bugs.mageia.org/show_bug.cgi?id=12384
lwn.net/Vulnerabilities/581307
security.gentoo.org/glsa/glsa-201401-13.xml
ubuntu.com/security/CVE-2014-0406
cve.org/CVERecord?id=CVE-2014-0406