{"id":"CVE-2014-0983","aliases":["DSA-2904-1","EUVD-2014-1013","GHSA-p4cx-p88v-xqv9","MGASA-2014-0184","MGASA-2014-0185","UBUNTU-CVE-2014-0983"],"status":"published","title":"Multiple array index errors in programs that are automatically generated by VBox/HostServices...","description":"Multiple array index errors in programs that are automatically generated by VBox/HostServices/SharedOpenGL/crserverlib/server_dispatch.py in Oracle VirtualBox 4.2.x through 4.2.20 and 4.3.x before 4.3.8, when using 3D Acceleration, allow local guest OS users to execute arbitrary code on the Chromium server via certain CR_MESSAGE_OPCODES messages with a crafted index, which are not properly handled by the (1) CR_VERTEXATTRIB4NUBARB_OPCODE to the crServerDispatchVertexAttrib4NubARB function, (2) CR_VERTEXATTRIB1DARB_OPCODE to the crServerDispatchVertexAttrib1dARB function, (3) CR_VERTEXATTRIB1FARB_OPCODE to the crServerDispatchVertexAttrib1fARB function, (4) CR_VERTEXATTRIB1SARB_OPCODE to the crServerDispatchVertexAttrib1sARB function, (5) CR_VERTEXATTRIB2DARB_OPCODE to the crServerDispatchVertexAttrib2dARB function, (6) CR_VERTEXATTRIB2FARB_OPCODE to the crServerDispatchVertexAttrib2fARB function, (7) CR_VERTEXATTRIB2SARB_OPCODE to the crServerDispatchVertexAttrib2sARB function, (8) CR_VERTEXATTRIB3DARB_OPCODE to the crServerDispatchVertexAttrib3dARB function, (9) CR_VERTEXATTRIB3FARB_OPCODE to the crServerDispatchVertexAttrib3fARB function, (10) CR_VERTEXATTRIB3SARB_OPCODE to the crServerDispatchVertexAttrib3sARB function, (11) CR_VERTEXATTRIB4DARB_OPCODE to the crServerDispatchVertexAttrib4dARB function, (12) CR_VERTEXATTRIB4FARB_OPCODE to the crServerDispatchVertexAttrib4fARB function, and (13) CR_VERTEXATTRIB4SARB_OPCODE to the crServerDispatchVertexAttrib4sARB function.","severity":{"version":"2.0","score":6.9,"vector":"AV:L/AC:M/Au:N/C:C/I:C/A:C","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.08129,"percentile":0.94879,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-399"],"published":"2014-03-28T21:00:00Z","modified":"2026-06-17T00:03:57Z","exploits":[{"source":"metasploit","id":"exploit/windows/local/virtual_box_opengl_escape","title":"VirtualBox 3D Acceleration Virtual Machine Escape","type":"exploit","platform":"Windows","date":"2014-03-11","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/windows/local/virtual_box_opengl_escape"},{"source":"exploitdb","id":"EDB-32208","title":"Oracle VM VirtualBox - 3D Acceleration Multiple Vulnerabilities","type":"dos","platform":"multiple","date":"2014-03-12","verified":true,"url":"https://www.exploit-db.com/exploits/32208"},{"source":"exploitdb","id":"EDB-34334","title":"Oracle VM VirtualBox 4.3.6 - 3D Acceleration Virtual Machine Escape (Metasploit)","type":"remote","platform":"windows_x86-64","date":"2014-08-14","verified":true,"url":"https://www.exploit-db.com/exploits/34334"}],"affected":[{"source":"osv","ecosystem":"Debian:6.0","package":"virtualbox-ose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.10-dfsg-1+squeeze3"}]}],"versions":["3.2.10-dfsg-1","3.2.10-dfsg-1+squeeze1","3.2.10-dfsg-1+squeeze2"],"bundled":2},{"source":"osv","ecosystem":"Debian:7","package":"virtualbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.18-dfsg-2+deb7u3"}]}],"versions":["4.1.18-dfsg-2+deb7u1","4.1.18-dfsg-2+deb7u2","4.1.18-dfsg-2+deb7u3~bpo60+1"],"bundled":2},{"source":"osv","ecosystem":"Mageia:3","package":"kmod-vboxadditions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.10-1.mga3"}]}],"bundled":7},{"source":"osv","ecosystem":"Mageia:3","package":"kmod-virtualbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.10-1.mga3"}]}],"bundled":7},{"source":"osv","ecosystem":"Mageia:3","package":"virtualbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.10-1.mga3"}]}],"bundled":7},{"source":"osv","ecosystem":"Mageia:4","package":"kmod-vboxadditions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.10-1.mga4"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:4","package":"kmod-virtualbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.10-1.mga4"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:4","package":"virtualbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.10-1.1.mga4"}]}],"bundled":2}],"products":[{"vendor":"oracle","product":"vm_virtualbox"}],"references":[{"url":"http://www.exploit-db.com/exploits/32208","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"]},{"url":"https://security.gentoo.org/glsa/201612-27","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred"]},{"url":"http://secunia.com/advisories/57384","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","report"]},{"url":"http://www.securityfocus.com/archive/1/531418/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"http://www.debian.org/security/2014/dsa-2904","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://www.virtualbox.org/changeset/50441/vbox","tags":["x_refsource_CONFIRM","x_transferred","report"]},{"url":"http://seclists.org/fulldisclosure/2014/Mar/95","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","Exploit","report"]},{"url":"http://www.coresecurity.com/advisories/oracle-virtualbox-3d-acceleration-multiple-memory-corruption-vulnerabilities","tags":["x_refsource_MISC","x_transferred","Exploit","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0983"},{"url":"https://github.com/advisories/GHSA-p4cx-p88v-xqv9"},{"url":"https://advisories.mageia.org/MGASA-2014-0184.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=12384","tags":["report"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=12578","tags":["report"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=8826","tags":["report"]},{"url":"http://lwn.net/Vulnerabilities/581307/","tags":["web"]},{"url":"http://security.gentoo.org/glsa/glsa-201401-13.xml","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2014-0185.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=13225","tags":["report"]},{"url":"https://www.debian.org/security/2014/dsa-2904.en.html","tags":["web"]},{"url":"https://www.virtualbox.org/wiki/Changelog","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2014-0983","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0983","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2014-0983","description":"Multiple array index errors in programs that are automatically generated by VBox/HostServices/SharedOpenGL/crserverlib/server_dispatch.py in Oracle VirtualBox 4.2.x through 4.2.20 and 4.3.x before 4.3.8, when using 3D Acceleration, allow local guest OS users to execute arbitrary code on the Chromium server via certain CR_MESSAGE_OPCODES messages with a crafted index, which are not properly handled by the (1) CR_VERTEXATTRIB4NUBARB_OPCODE to the crServerDispatchVertexAttrib4NubARB function, (2) CR_VERTEXATTRIB1DARB_OPCODE to the crServerDispatchVertexAttrib1dARB function, (3) CR_VERTEXATTRIB1FARB_OPCODE to the crServerDispatchVertexAttrib1fARB function, (4) CR_VERTEXATTRIB1SARB_OPCODE to the crServerDispatchVertexAttrib1sARB function, (5) CR_VERTEXATTRIB2DARB_OPCODE to the crServerDispatchVertexAttrib2dARB function, (6) CR_VERTEXATTRIB2FARB_OPCODE to the crServerDispatchVertexAttrib2fARB function, (7) CR_VERTEXATTRIB2SARB_OPCODE to the crServerDispatchVertexAttrib2sARB function, (8) CR_VERTEXATTRIB3DARB_OPCODE to the crServerDispatchVertexAttrib3dARB function, (9) CR_VERTEXATTRIB3FARB_OPCODE to the crServerDispatchVertexAttrib3fARB function, (10) CR_VERTEXATTRIB3SARB_OPCODE to the crServerDispatchVertexAttrib3sARB function, (11) CR_VERTEXATTRIB4DARB_OPCODE to the crServerDispatchVertexAttrib4dARB function, (12) CR_VERTEXATTRIB4FARB_OPCODE to the crServerDispatchVertexAttrib4fARB function, and (13) CR_VERTEXATTRIB4SARB_OPCODE to the crServerDispatchVertexAttrib4sARB function.","status":"published","published":"2014-03-28T21:00:00Z","modified":"2024-08-06T09:34:40.477Z","updated_at":"2026-11-02T14:33:47.330011Z"}],"euvd":[{"id":"EUVD-2014-1013","description":"Multiple array index errors in programs that are automatically generated by VBox/HostServices/SharedOpenGL/crserverlib/server_dispatch.py in Oracle VirtualBox 4.2.x through 4.2.20 and 4.3.x before 4.3.8, when using 3D Acceleration, allow local guest OS users to execute arbitrary code on the Chromium server via certain CR_MESSAGE_OPCODES messages with a crafted index, which are not properly handled by the (1) CR_VERTEXATTRIB4NUBARB_OPCODE to the crServerDispatchVertexAttrib4NubARB function, (2) CR_VERTEXATTRIB1DARB_OPCODE to the crServerDispatchVertexAttrib1dARB function, (3) CR_VERTEXATTRIB1FARB_OPCODE to the crServerDispatchVertexAttrib1fARB function, (4) CR_VERTEXATTRIB1SARB_OPCODE to the crServerDispatchVertexAttrib1sARB function, (5) CR_VERTEXATTRIB2DARB_OPCODE to the crServerDispatchVertexAttrib2dARB function, (6) CR_VERTEXATTRIB2FARB_OPCODE to the crServerDispatchVertexAttrib2fARB function, (7) CR_VERTEXATTRIB2SARB_OPCODE to the crServerDispatchVertexAttrib2sARB function, (8) CR_VERTEXATTRIB3DARB_OPCODE to the crServerDispatchVertexAttrib3dARB function, (9) CR_VERTEXATTRIB3FARB_OPCODE to the crServerDispatchVertexAttrib3fARB function, (10) CR_VERTEXATTRIB3SARB_OPCODE to the crServerDispatchVertexAttrib3sARB function, (11) CR_VERTEXATTRIB4DARB_OPCODE to the crServerDispatchVertexAttrib4dARB function, (12) CR_VERTEXATTRIB4FARB_OPCODE to the crServerDispatchVertexAttrib4fARB function, and (13) CR_VERTEXATTRIB4SARB_OPCODE to the crServerDispatchVertexAttrib4sARB function.","status":"published","published":"2014-03-28T21:00:00Z","modified":"2024-08-06T09:34:40Z","updated_at":"2026-11-03T01:57:19.225526Z"}],"ghsa":[{"id":"GHSA-p4cx-p88v-xqv9","title":"Multiple array index errors in programs that are automatically generated by VBox/HostServices...","description":"Multiple array index errors in programs that are automatically generated by VBox/HostServices/SharedOpenGL/crserverlib/server_dispatch.py in Oracle VirtualBox 4.2.x through 4.2.20 and 4.3.x before 4.3.8, when using 3D Acceleration, allow local guest OS users to execute arbitrary code on the Chromium server via certain CR_MESSAGE_OPCODES messages with a crafted index, which are not properly handled by the (1) CR_VERTEXATTRIB4NUBARB_OPCODE to the crServerDispatchVertexAttrib4NubARB function, (2) CR_VERTEXATTRIB1DARB_OPCODE to the crServerDispatchVertexAttrib1dARB function, (3) CR_VERTEXATTRIB1FARB_OPCODE to the crServerDispatchVertexAttrib1fARB function, (4) CR_VERTEXATTRIB1SARB_OPCODE to the crServerDispatchVertexAttrib1sARB function, (5) CR_VERTEXATTRIB2DARB_OPCODE to the crServerDispatchVertexAttrib2dARB function, (6) CR_VERTEXATTRIB2FARB_OPCODE to the crServerDispatchVertexAttrib2fARB function, (7) CR_VERTEXATTRIB2SARB_OPCODE to the crServerDispatchVertexAttrib2sARB function, (8) CR_VERTEXATTRIB3DARB_OPCODE to the crServerDispatchVertexAttrib3dARB function, (9) CR_VERTEXATTRIB3FARB_OPCODE to the crServerDispatchVertexAttrib3fARB function, (10) CR_VERTEXATTRIB3SARB_OPCODE to the crServerDispatchVertexAttrib3sARB function, (11) CR_VERTEXATTRIB4DARB_OPCODE to the crServerDispatchVertexAttrib4dARB function, (12) CR_VERTEXATTRIB4FARB_OPCODE to the crServerDispatchVertexAttrib4fARB function, and (13) CR_VERTEXATTRIB4SARB_OPCODE to the crServerDispatchVertexAttrib4sARB function.","status":"published","published":"2022-05-14T02:53:40Z","modified":"2023-02-02T05:06:49Z","updated_at":"2026-11-02T14:52:22.708662Z"}],"nvd":[{"id":"CVE-2014-0983","description":"Multiple array index errors in programs that are automatically generated by VBox/HostServices/SharedOpenGL/crserverlib/server_dispatch.py in Oracle VirtualBox 4.2.x through 4.2.20 and 4.3.x before 4.3.8, when using 3D Acceleration, allow local guest OS users to execute arbitrary code on the Chromium server via certain CR_MESSAGE_OPCODES messages with a crafted index, which are not properly handled by the (1) CR_VERTEXATTRIB4NUBARB_OPCODE to the crServerDispatchVertexAttrib4NubARB function, (2) CR_VERTEXATTRIB1DARB_OPCODE to the crServerDispatchVertexAttrib1dARB function, (3) CR_VERTEXATTRIB1FARB_OPCODE to the crServerDispatchVertexAttrib1fARB function, (4) CR_VERTEXATTRIB1SARB_OPCODE to the crServerDispatchVertexAttrib1sARB function, (5) CR_VERTEXATTRIB2DARB_OPCODE to the crServerDispatchVertexAttrib2dARB function, (6) CR_VERTEXATTRIB2FARB_OPCODE to the crServerDispatchVertexAttrib2fARB function, (7) CR_VERTEXATTRIB2SARB_OPCODE to the crServerDispatchVertexAttrib2sARB function, (8) CR_VERTEXATTRIB3DARB_OPCODE to the crServerDispatchVertexAttrib3dARB function, (9) CR_VERTEXATTRIB3FARB_OPCODE to the crServerDispatchVertexAttrib3fARB function, (10) CR_VERTEXATTRIB3SARB_OPCODE to the crServerDispatchVertexAttrib3sARB function, (11) CR_VERTEXATTRIB4DARB_OPCODE to the crServerDispatchVertexAttrib4dARB function, (12) CR_VERTEXATTRIB4FARB_OPCODE to the crServerDispatchVertexAttrib4fARB function, and (13) CR_VERTEXATTRIB4SARB_OPCODE to the crServerDispatchVertexAttrib4sARB function.","status":"published","published":"2014-03-31T14:58:35.663Z","modified":"2026-06-17T00:03:57.83Z","cvss":[{"version":"2.0","score":6.9,"vector":"AV:L/AC:M/Au:N/C:C/I:C/A:C","level":"medium","assessor":"primary"}],"cwes":["CWE-399"],"updated_at":"2026-11-02T14:02:53.710973Z"}],"osv":[{"id":"DSA-2904-1","title":"virtualbox - security update","status":"published","published":"2014-04-15T00:00:00Z","modified":"2026-03-09T01:20:29.945674Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"MGASA-2014-0184","title":"Updated virtualbox packages fixes security vulnerabilities","description":"Multiple vulnerabilities in the Oracle VM VirtualBox component in Oracle\nVirtualization VirtualBox prior to 3.2.20, 4.0.22, 4.1.30, 4.2.20, and\n4.3.4 allows local users to affect integrity and availability via unknown\nvectors related to Core (CVE-2013-5892, CVE-2014-0404, CVE-2014-0405,\nCVE-2014-0406, CVE-2014-0407).\n\nVBox/GuestHost/OpenGL/util/net.c in Oracle VirtualBox before 3.2.22, 4.0.x\nbefore 4.0.24, 4.1.x before 4.1.32, 4.2.x before 4.2.24, and 4.3.x before\n4.3.8, when using 3D Acceleration allows local guest OS users to execute\narbitrary code on the Chromium server via crafted Chromium network pointer\nin a CR_MESSAGE_READBACK or CR_MESSAGE_WRITEBACK message to the\nVBoxSharedCrOpenGL service, which triggers an arbitrary pointer\ndereference and memory corruption (CVE-2014-0981).\n\nMultiple array index errors in programs that are automatically generated by\nVBox/HostServices/SharedOpenGL/crserverlib/server_dispatch.py in Oracle\nVirtualBox 4.2.x through 4.2.20 and 4.3.x before 4.3.8, when using 3D\nAcceleration, allow local guest OS users to execute arbitrary code on the\nChromium server via certain CR_MESSAGE_OPCODES messages with a crafted\nindex, which are not properly handled (CVE-2014-0983).\n\nThe virtualbox packages has been updated to 4.3.10 maintenance release that\nresolves theese issues and other upstream reported issues (for more info\ncheck the referenced changelog).\n\nThis update also resolves the following:\n- load virtualbox modules on install (mga#8826)\n- missing GUI translations (mga#12578)\n","status":"published","published":"2014-04-20T18:48:47Z","modified":"2026-04-16T06:24:06.444979828Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"MGASA-2014-0185","title":"Updated virtualbox packages fixes security vulnerabilities","description":"VBox/GuestHost/OpenGL/util/net.c in Oracle VirtualBox before 3.2.22, 4.0.x\nbefore 4.0.24, 4.1.x before 4.1.32, 4.2.x before 4.2.24, and 4.3.x before\n4.3.8, when using 3D Acceleration allows local guest OS users to execute\narbitrary code on the Chromium server via crafted Chromium network pointer\nin a CR_MESSAGE_READBACK or CR_MESSAGE_WRITEBACK message to the\nVBoxSharedCrOpenGL service, which triggers an arbitrary pointer\ndereference and memory corruption (CVE-2014-0981).\n\nMultiple array index errors in programs that are automatically generated\nby VBox/HostServices/SharedOpenGL/crserverlib/server_dispatch.py in Oracle\nVirtualBox 4.2.x through 4.2.20 and 4.3.x before 4.3.8, when using 3D\nAcceleration, allow local guest OS users to execute arbitrary code on the\nChromium server via certain CR_MESSAGE_OPCODES messages with a crafted\nindex, which are not properly handled (CVE-2014-0983).\n\nThe virtualbox packages has been updated to 4.3.10 maintenance release\nthat resolves theese issues and other upstream reported issues (for more\ninfo check the referenced changelog).\n\nThis update also resolves the following:\n- load virtualbox modules on install (mga#8826)\n- missing GUI translations (mga#12578)\n","status":"published","published":"2014-04-20T18:54:57Z","modified":"2026-04-16T06:24:23.769886071Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"UBUNTU-CVE-2014-0983","description":"Multiple array index errors in programs that are automatically generated by VBox/HostServices/SharedOpenGL/crserverlib/server_dispatch.py in Oracle VirtualBox 4.2.x through 4.2.20 and 4.3.x before 4.3.8, when using 3D Acceleration, allow local guest OS users to execute arbitrary code on the Chromium server via certain CR_MESSAGE_OPCODES messages with a crafted index, which are not properly handled by the (1) CR_VERTEXATTRIB4NUBARB_OPCODE to the crServerDispatchVertexAttrib4NubARB function, (2) CR_VERTEXATTRIB1DARB_OPCODE to the crServerDispatchVertexAttrib1dARB function, (3) CR_VERTEXATTRIB1FARB_OPCODE to the crServerDispatchVertexAttrib1fARB function, (4) CR_VERTEXATTRIB1SARB_OPCODE to the crServerDispatchVertexAttrib1sARB function, (5) CR_VERTEXATTRIB2DARB_OPCODE to the crServerDispatchVertexAttrib2dARB function, (6) CR_VERTEXATTRIB2FARB_OPCODE to the crServerDispatchVertexAttrib2fARB function, (7) CR_VERTEXATTRIB2SARB_OPCODE to the crServerDispatchVertexAttrib2sARB function, (8) CR_VERTEXATTRIB3DARB_OPCODE to the crServerDispatchVertexAttrib3dARB function, (9) CR_VERTEXATTRIB3FARB_OPCODE to the crServerDispatchVertexAttrib3fARB function, (10) CR_VERTEXATTRIB3SARB_OPCODE to the crServerDispatchVertexAttrib3sARB function, (11) CR_VERTEXATTRIB4DARB_OPCODE to the crServerDispatchVertexAttrib4dARB function, (12) CR_VERTEXATTRIB4FARB_OPCODE to the crServerDispatchVertexAttrib4fARB function, and (13) CR_VERTEXATTRIB4SARB_OPCODE to the crServerDispatchVertexAttrib4sARB function.","status":"withdrawn","published":"2014-03-31T14:58:00Z","modified":"2025-07-16T07:31:40.690464Z","updated_at":"2026-11-02T15:54:07.855521Z"}]}}