{"id":"CVE-2015-4896","aliases":["DSA-3384-1","EUVD-2015-4913","GHSA-jjhg-cr8w-r8h7","MGASA-2015-0415","UBUNTU-CVE-2015-4896","openSUSE-SU-2024:10020-1"],"status":"published","title":"Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization...","description":"Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox before 4.0.34, 4.1.42, 4.2.34, 4.3.32, and 5.0.8, when a VM has the Remote Display feature (RDP) enabled, allows remote attackers to affect availability via unknown vectors related to Core.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.03667,"percentile":0.8972,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2015-10-21T23:00:00Z","modified":"2026-06-17T00:28:08Z","fixes":[{"ecosystem":"Ubuntu:14.04:LTS","package":"virtualbox","fixed_in":["4.3.34-dfsg-1+deb8u1ubuntu1.14.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:7","package":"virtualbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.42-dfsg-1+deb7u1"}]}],"versions":["4.1.18-dfsg-2+deb7u1","4.1.18-dfsg-2+deb7u2","4.1.18-dfsg-2+deb7u3","4.1.18-dfsg-2+deb7u3~bpo60+1","4.1.18-dfsg-2+deb7u4","4.1.18-dfsg-2+deb7u4~bpo60+1","4.1.18-dfsg-2+deb7u5","4.1.18-dfsg-2.1","4.1.40-dfsg-1+deb7u1","4.1.42-dfsg-1+deb7u1~bpo60+1"],"bundled":2},{"source":"osv","ecosystem":"Debian:8","package":"virtualbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.32-dfsg-1+deb8u2"}]}],"versions":["1.4.0svn4130-dfsg-1","4.0.10-dfsg-1","4.0.10-dfsg-1~bpo60+1","4.0.10-dfsg-1~bpo60+2","4.0.8-dfsg-1","4.0.8-dfsg-2","4.0.8-dfsg-2~bpo60+1","4.1.0-dfsg-1","4.1.0-dfsg-2","4.1.10-dfsg-1","4.1.12-dfsg-1","4.1.12-dfsg-2","4.1.14-dfsg-1","4.1.14-dfsg-2","4.1.16-dfsg-1","4.1.16-dfsg-2","4.1.18-dfsg-1","4.1.18-dfsg-1.1","4.1.18-dfsg-2","4.1.18-dfsg-2.1","4.1.2-dfsg-1","4.1.4-dfsg-1","4.1.6-dfsg-1","4.1.6-dfsg-2","4.1.8-dfsg-1","4.1.8-dfsg-2","4.2.10-dfsg-1","4.2.10-dfsg-1~bpo70+1","4.2.16-dfsg-1","4.2.16-dfsg-1~bpo70+1","4.2.16-dfsg-2","4.2.16-dfsg-3","4.2.16-dfsg-3~bpo70+1","4.3.10-dfsg-1","4.3.10-dfsg-1~bpo70+1","4.3.12-dfsg-1","4.3.12-dfsg-1~bpo70+1","4.3.14-dfsg-1","4.3.14-dfsg-1~bpo70+1","4.3.18-dfsg-1","4.3.18-dfsg-2","4.3.18-dfsg-2~bpo70+1","4.3.18-dfsg-3","4.3.18-dfsg-3+deb8u1","4.3.18-dfsg-3+deb8u2","4.3.18-dfsg-3+deb8u3","4.3.2-dfsg-1","4.3.20-dfsg-1","4.3.22-dfsg-1","4.3.24-dfsg-1","4.3.26-dfsg-1","4.3.26-dfsg-2","4.3.26-dfsg-3","4.3.28-dfsg-1","4.3.30-dfsg-1","4.3.30-dfsg-1+deb8u1","4.3.32-dfsg-1+deb8u2~bpo60+1","4.3.32-dfsg-1+deb8u2~bpo70+1","4.3.6-dfsg-1","4.3.6-dfsg-2","4.3.6-dfsg-2~bpo70+1"],"bundled":2},{"source":"osv","ecosystem":"Mageia:5","package":"kmod-vboxadditions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.8-1.mga5"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:5","package":"kmod-virtualbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.8-1.mga5"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:5","package":"virtualbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.8-1.mga5"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"virtualbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.34-dfsg-1+deb8u1ubuntu1.14.04.1"}]}],"versions":["4.2.16-dfsg-3","4.2.16-dfsg-3ubuntu1","4.3.2-dfsg-1","4.3.2-dfsg-1ubuntu1","4.3.2-dfsg-1ubuntu2","4.3.6-dfsg-1","4.3.6-dfsg-2","4.3.10-dfsg-1","4.3.10-dfsg-1ubuntu1","4.3.10-dfsg-1ubuntu2","4.3.10-dfsg-1ubuntu3","4.3.10-dfsg-1ubuntu4","4.3.10-dfsg-1ubuntu5"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"virtualbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.10-2.5"}]}],"bundled":19}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"oracle","product":"vm_virtualbox"}],"references":[{"url":"http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory"]},{"url":"http://lists.opensuse.org/opensuse-updates/2015-11/msg00000.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-updates/2015-11/msg00172.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory"]},{"url":"http://www.securitytracker.com/id/1033880","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://www.securityfocus.com/bid/77198","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://www.debian.org/security/2015/dsa-3384","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Mailing List","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-4896"},{"url":"https://github.com/advisories/GHSA-jjhg-cr8w-r8h7"},{"url":"https://advisories.mageia.org/MGASA-2015-0415.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=17015","tags":["report"]},{"url":"http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html#AppendixOVIR","tags":["web","report"]},{"url":"https://www.virtualbox.org/wiki/Changelog","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2015-4896","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-4896","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0224","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-6588","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-6589","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-6590","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-6595","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0377","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0418","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0427","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3456","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4813","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4896","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0678","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5501","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5538","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5605","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5608","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5610","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5611","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-561313","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2015-4896","description":"Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox before 4.0.34, 4.1.42, 4.2.34, 4.3.32, and 5.0.8, when a VM has the Remote Display feature (RDP) enabled, allows remote attackers to affect availability via unknown vectors related to Core.","status":"published","published":"2015-10-21T23:00:00Z","modified":"2024-08-06T06:25:21.962Z","updated_at":"2026-11-02T14:35:43.698357Z"}],"euvd":[{"id":"EUVD-2015-4913","description":"Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox before 4.0.34, 4.1.42, 4.2.34, 4.3.32, and 5.0.8, when a VM has the Remote Display feature (RDP) enabled, allows remote attackers to affect availability via unknown vectors related to Core.","status":"published","published":"2015-10-21T23:00:00Z","modified":"2024-08-06T06:25:21Z","updated_at":"2026-11-03T02:22:02.164917Z"}],"ghsa":[{"id":"GHSA-jjhg-cr8w-r8h7","title":"Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization...","description":"Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox before 4.0.34, 4.1.42, 4.2.34, 4.3.32, and 5.0.8, when a VM has the Remote Display feature (RDP) enabled, allows remote attackers to affect availability via unknown vectors related to Core.","status":"published","published":"2022-05-14T01:34:50Z","modified":"2023-02-02T05:04:08Z","updated_at":"2026-11-02T14:51:47.947252Z"}],"nvd":[{"id":"CVE-2015-4896","description":"Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox before 4.0.34, 4.1.42, 4.2.34, 4.3.32, and 5.0.8, when a VM has the Remote Display feature (RDP) enabled, allows remote attackers to affect availability via unknown vectors related to Core.","status":"published","published":"2015-10-21T23:59:56.81Z","modified":"2026-06-17T00:28:08.263Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:03:10.919251Z"}],"osv":[{"id":"DSA-3384-1","title":"virtualbox - security update","status":"published","published":"2015-10-29T00:00:00Z","modified":"2026-03-09T01:21:24.197694Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"MGASA-2015-0415","title":"Updated virtualbox packages fix security vulnerabilities","description":"A vulnerability in the Oracle VM VirtualBox component prior to 4.0.34,\n4.1.42, 4.2.34, 4.3.32 and 5.0.8. Easily exploitable vulnerability\nrequiring logon to Operating System. Successful attack of this\nvulnerability can result in unauthorized ability to cause a hang or\nfrequently repeatable crash (complete DOS). \nNote: Only Windows guests are impacted, and Windows guests without\nVirtualBox Guest Additions installed are not affected (CVE-2015-4813).\n\nA vulnerability in the Oracle VM VirtualBox component prior to 4.0.34,\n4.1.42, 4.2.34, 4.3.32 and 5.0.8. Easily exploitable vulnerability allows\nsuccessful unauthenticated network attacks. Successful attack of this\nvulnerability can result in unauthorized ability to cause a hang or\nfrequently repeatable crash (complete DOS).\nNote: Only VMs with Remote Display feature (RDP) enabled are impacted\n(CVE-2015-4896).\n\nFor other fixes in this update, see the referenced changelog.\n","status":"published","published":"2015-10-27T09:06:52Z","modified":"2026-04-16T06:26:21.033517009Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"openSUSE-SU-2024:10020-1","title":"python-virtualbox-5.1.10-2.5 on GA media","description":"These are all security issues fixed in the python-virtualbox-5.1.10-2.5 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:12:58.917626Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"UBUNTU-CVE-2015-4896","description":"Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox before 4.0.34, 4.1.42, 4.2.34, 4.3.32, and 5.0.8, when a VM has the Remote Display feature (RDP) enabled, allows remote attackers to affect availability via unknown vectors related to Core.","status":"published","published":"2015-10-21T23:59:00Z","modified":"2025-09-08T16:43:24Z","updated_at":"2026-11-02T15:54:10.385269Z"}]}}