{"id":"CVE-2014-0981","aliases":["DSA-2904-1","EUVD-2014-1011","GHSA-jg2m-q6h3-v5jg","MGASA-2014-0184","MGASA-2014-0185","UBUNTU-CVE-2014-0981"],"status":"published","title":"VBox/GuestHost/OpenGL/util/net.c in Oracle VirtualBox before 3.2.22, 4.0.x before 4.0.24, 4.1.x...","description":"VBox/GuestHost/OpenGL/util/net.c in Oracle VirtualBox before 3.2.22, 4.0.x before 4.0.24, 4.1.x before 4.1.32, 4.2.x before 4.2.24, and 4.3.x before 4.3.8, when using 3D Acceleration allows local guest OS users to execute arbitrary code on the Chromium server via crafted Chromium network pointer in a (1) CR_MESSAGE_READBACK or (2) CR_MESSAGE_WRITEBACK message to the VBoxSharedCrOpenGL service, which triggers an arbitrary pointer dereference and memory corruption.  NOTE: this issue was MERGED with CVE-2014-0982 because it is the same type of vulnerability affecting the same set of versions. All CVE users should reference CVE-2014-0981 instead of CVE-2014-0982.","severity":{"version":"2.0","score":4.4,"vector":"AV:L/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01383,"percentile":0.72368,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-399"],"published":"2014-03-28T21:00:00Z","modified":"2026-06-17T00:03:57Z","exploits":[{"source":"exploitdb","id":"EDB-32208","title":"Oracle VM VirtualBox - 3D Acceleration Multiple Vulnerabilities","type":"dos","platform":"multiple","date":"2014-03-12","verified":true,"url":"https://www.exploit-db.com/exploits/32208"}],"affected":[{"source":"osv","ecosystem":"Debian:6.0","package":"virtualbox-ose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.10-dfsg-1+squeeze3"}]}],"versions":["3.2.10-dfsg-1","3.2.10-dfsg-1+squeeze1","3.2.10-dfsg-1+squeeze2"],"bundled":2},{"source":"osv","ecosystem":"Debian:7","package":"virtualbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.18-dfsg-2+deb7u3"}]}],"versions":["4.1.18-dfsg-2+deb7u1","4.1.18-dfsg-2+deb7u2","4.1.18-dfsg-2+deb7u3~bpo60+1"],"bundled":2},{"source":"osv","ecosystem":"Mageia:3","package":"kmod-vboxadditions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.10-1.mga3"}]}],"bundled":7},{"source":"osv","ecosystem":"Mageia:3","package":"kmod-virtualbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.10-1.mga3"}]}],"bundled":7},{"source":"osv","ecosystem":"Mageia:3","package":"virtualbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.10-1.mga3"}]}],"bundled":7},{"source":"osv","ecosystem":"Mageia:4","package":"kmod-vboxadditions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.10-1.mga4"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:4","package":"kmod-virtualbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.10-1.mga4"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:4","package":"virtualbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.10-1.1.mga4"}]}],"bundled":2}],"products":[{"vendor":"oracle","product":"vm_virtualbox"}],"references":[{"url":"http://www.exploit-db.com/exploits/32208","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"]},{"url":"https://security.gentoo.org/glsa/201612-27","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred"]},{"url":"http://secunia.com/advisories/57384","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","report"]},{"url":"http://www.securityfocus.com/archive/1/531418/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"http://www.debian.org/security/2014/dsa-2904","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://www.virtualbox.org/changeset/50437/vbox","tags":["x_refsource_CONFIRM","x_transferred","report"]},{"url":"http://seclists.org/fulldisclosure/2014/Mar/95","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","Exploit","report"]},{"url":"http://www.coresecurity.com/advisories/oracle-virtualbox-3d-acceleration-multiple-memory-corruption-vulnerabilities","tags":["x_refsource_MISC","x_transferred","Exploit","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0981"},{"url":"https://github.com/advisories/GHSA-jg2m-q6h3-v5jg"},{"url":"https://advisories.mageia.org/MGASA-2014-0184.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=12384","tags":["report"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=12578","tags":["report"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=8826","tags":["report"]},{"url":"http://lwn.net/Vulnerabilities/581307/","tags":["web"]},{"url":"http://security.gentoo.org/glsa/glsa-201401-13.xml","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2014-0185.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=13225","tags":["report"]},{"url":"https://www.debian.org/security/2014/dsa-2904.en.html","tags":["web"]},{"url":"https://www.virtualbox.org/wiki/Changelog","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2014-0981","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0981","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2014-0981","description":"VBox/GuestHost/OpenGL/util/net.c in Oracle VirtualBox before 3.2.22, 4.0.x before 4.0.24, 4.1.x before 4.1.32, 4.2.x before 4.2.24, and 4.3.x before 4.3.8, when using 3D Acceleration allows local guest OS users to execute arbitrary code on the Chromium server via crafted Chromium network pointer in a (1) CR_MESSAGE_READBACK or (2) CR_MESSAGE_WRITEBACK message to the VBoxSharedCrOpenGL service, which triggers an arbitrary pointer dereference and memory corruption.  NOTE: this issue was MERGED with CVE-2014-0982 because it is the same type of vulnerability affecting the same set of versions. All CVE users should reference CVE-2014-0981 instead of CVE-2014-0982.","status":"published","published":"2014-03-28T21:00:00Z","modified":"2024-08-06T09:34:40.679Z","updated_at":"2026-11-02T14:33:47.741012Z"}],"euvd":[{"id":"EUVD-2014-1011","description":"VBox/GuestHost/OpenGL/util/net.c in Oracle VirtualBox before 3.2.22, 4.0.x before 4.0.24, 4.1.x before 4.1.32, 4.2.x before 4.2.24, and 4.3.x before 4.3.8, when using 3D Acceleration allows local guest OS users to execute arbitrary code on the Chromium server via crafted Chromium network pointer in a (1) CR_MESSAGE_READBACK or (2) CR_MESSAGE_WRITEBACK message to the VBoxSharedCrOpenGL service, which triggers an arbitrary pointer dereference and memory corruption.  NOTE: this issue was MERGED with CVE-2014-0982 because it is the same type of vulnerability affecting the same set of versions. All CVE users should reference CVE-2014-0981 instead of CVE-2014-0982.","status":"published","published":"2014-03-28T21:00:00Z","modified":"2024-08-06T09:34:40Z","updated_at":"2026-11-03T01:57:19.225526Z"}],"ghsa":[{"id":"GHSA-jg2m-q6h3-v5jg","title":"VBox/GuestHost/OpenGL/util/net.c in Oracle VirtualBox before 3.2.22, 4.0.x before 4.0.24, 4.1.x...","description":"VBox/GuestHost/OpenGL/util/net.c in Oracle VirtualBox before 3.2.22, 4.0.x before 4.0.24, 4.1.x before 4.1.32, 4.2.x before 4.2.24, and 4.3.x before 4.3.8, when using 3D Acceleration allows local guest OS users to execute arbitrary code on the Chromium server via crafted Chromium network pointer in a (1) CR_MESSAGE_READBACK or (2) CR_MESSAGE_WRITEBACK message to the VBoxSharedCrOpenGL service, which triggers an arbitrary pointer dereference and memory corruption.  NOTE: this issue was MERGED with CVE-2014-0982 because it is the same type of vulnerability affecting the same set of versions. All CVE users should reference CVE-2014-0981 instead of CVE-2014-0982.","status":"published","published":"2022-05-14T02:53:40Z","modified":"2023-02-02T05:06:32Z","updated_at":"2026-11-02T14:52:19.633418Z"}],"nvd":[{"id":"CVE-2014-0981","description":"VBox/GuestHost/OpenGL/util/net.c in Oracle VirtualBox before 3.2.22, 4.0.x before 4.0.24, 4.1.x before 4.1.32, 4.2.x before 4.2.24, and 4.3.x before 4.3.8, when using 3D Acceleration allows local guest OS users to execute arbitrary code on the Chromium server via crafted Chromium network pointer in a (1) CR_MESSAGE_READBACK or (2) CR_MESSAGE_WRITEBACK message to the VBoxSharedCrOpenGL service, which triggers an arbitrary pointer dereference and memory corruption.  NOTE: this issue was MERGED with CVE-2014-0982 because it is the same type of vulnerability affecting the same set of versions. All CVE users should reference CVE-2014-0981 instead of CVE-2014-0982.","status":"published","published":"2014-03-31T14:58:35.57Z","modified":"2026-06-17T00:03:57.673Z","cvss":[{"version":"2.0","score":4.4,"vector":"AV:L/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-399"],"updated_at":"2026-11-02T14:02:53.710973Z"}],"osv":[{"id":"DSA-2904-1","title":"virtualbox - security update","status":"published","published":"2014-04-15T00:00:00Z","modified":"2026-03-09T01:20:29.945674Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"MGASA-2014-0184","title":"Updated virtualbox packages fixes security vulnerabilities","description":"Multiple vulnerabilities in the Oracle VM VirtualBox component in Oracle\nVirtualization VirtualBox prior to 3.2.20, 4.0.22, 4.1.30, 4.2.20, and\n4.3.4 allows local users to affect integrity and availability via unknown\nvectors related to Core (CVE-2013-5892, CVE-2014-0404, CVE-2014-0405,\nCVE-2014-0406, CVE-2014-0407).\n\nVBox/GuestHost/OpenGL/util/net.c in Oracle VirtualBox before 3.2.22, 4.0.x\nbefore 4.0.24, 4.1.x before 4.1.32, 4.2.x before 4.2.24, and 4.3.x before\n4.3.8, when using 3D Acceleration allows local guest OS users to execute\narbitrary code on the Chromium server via crafted Chromium network pointer\nin a CR_MESSAGE_READBACK or CR_MESSAGE_WRITEBACK message to the\nVBoxSharedCrOpenGL service, which triggers an arbitrary pointer\ndereference and memory corruption (CVE-2014-0981).\n\nMultiple array index errors in programs that are automatically generated by\nVBox/HostServices/SharedOpenGL/crserverlib/server_dispatch.py in Oracle\nVirtualBox 4.2.x through 4.2.20 and 4.3.x before 4.3.8, when using 3D\nAcceleration, allow local guest OS users to execute arbitrary code on the\nChromium server via certain CR_MESSAGE_OPCODES messages with a crafted\nindex, which are not properly handled (CVE-2014-0983).\n\nThe virtualbox packages has been updated to 4.3.10 maintenance release that\nresolves theese issues and other upstream reported issues (for more info\ncheck the referenced changelog).\n\nThis update also resolves the following:\n- load virtualbox modules on install (mga#8826)\n- missing GUI translations (mga#12578)\n","status":"published","published":"2014-04-20T18:48:47Z","modified":"2026-04-16T06:24:06.444979828Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"MGASA-2014-0185","title":"Updated virtualbox packages fixes security vulnerabilities","description":"VBox/GuestHost/OpenGL/util/net.c in Oracle VirtualBox before 3.2.22, 4.0.x\nbefore 4.0.24, 4.1.x before 4.1.32, 4.2.x before 4.2.24, and 4.3.x before\n4.3.8, when using 3D Acceleration allows local guest OS users to execute\narbitrary code on the Chromium server via crafted Chromium network pointer\nin a CR_MESSAGE_READBACK or CR_MESSAGE_WRITEBACK message to the\nVBoxSharedCrOpenGL service, which triggers an arbitrary pointer\ndereference and memory corruption (CVE-2014-0981).\n\nMultiple array index errors in programs that are automatically generated\nby VBox/HostServices/SharedOpenGL/crserverlib/server_dispatch.py in Oracle\nVirtualBox 4.2.x through 4.2.20 and 4.3.x before 4.3.8, when using 3D\nAcceleration, allow local guest OS users to execute arbitrary code on the\nChromium server via certain CR_MESSAGE_OPCODES messages with a crafted\nindex, which are not properly handled (CVE-2014-0983).\n\nThe virtualbox packages has been updated to 4.3.10 maintenance release\nthat resolves theese issues and other upstream reported issues (for more\ninfo check the referenced changelog).\n\nThis update also resolves the following:\n- load virtualbox modules on install (mga#8826)\n- missing GUI translations (mga#12578)\n","status":"published","published":"2014-04-20T18:54:57Z","modified":"2026-04-16T06:24:23.769886071Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"UBUNTU-CVE-2014-0981","description":"VBox/GuestHost/OpenGL/util/net.c in Oracle VirtualBox before 3.2.22, 4.0.x before 4.0.24, 4.1.x before 4.1.32, 4.2.x before 4.2.24, and 4.3.x before 4.3.8, when using 3D Acceleration allows local guest OS users to execute arbitrary code on the Chromium server via crafted Chromium network pointer in a (1) CR_MESSAGE_READBACK or (2) CR_MESSAGE_WRITEBACK message to the VBoxSharedCrOpenGL service, which triggers an arbitrary pointer dereference and memory corruption.  NOTE: this issue was MERGED with CVE-2014-0982 because it is the same type of vulnerability affecting the same set of versions. All CVE users should reference CVE-2014-0981 instead of CVE-2014-0982.","status":"withdrawn","published":"2014-03-31T14:58:00Z","modified":"2025-07-16T07:31:40.622024Z","updated_at":"2026-11-02T15:54:07.855521Z"}]}}