{"id":"CVE-2017-10407","aliases":["EUVD-2017-2054","GHSA-544p-f4g7-j9wh","MGASA-2017-0390","UBUNTU-CVE-2017-10407"],"status":"published","title":"Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core)...","description":"Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). The supported version that is affected is Prior to 5.1.30. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox as well as unauthorized update, insert or delete access to some of Oracle VM VirtualBox accessible data and unauthorized read access to a subset of Oracle VM VirtualBox accessible data. CVSS 3.0 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H).","severity":{"version":"3.0","score":7.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.00358,"percentile":0.29765,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2017-10-19T17:00:00Z","modified":"2026-06-17T01:00:22Z","affected":[{"source":"osv","ecosystem":"Mageia:5","package":"virtualbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.30-1.mga5"}]}],"bundled":8},{"source":"osv","ecosystem":"Mageia:5","package":"kmod-vboxadditions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.30-1.mga5"}]}],"bundled":8},{"source":"osv","ecosystem":"Mageia:5","package":"kmod-virtualbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.30-1.mga5"}]}],"bundled":8},{"source":"osv","ecosystem":"Mageia:6","package":"virtualbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.30-1.mga6"}]}],"bundled":8},{"source":"osv","ecosystem":"Mageia:6","package":"kmod-vboxadditions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.30-1.mga6"}]}],"bundled":8},{"source":"osv","ecosystem":"Mageia:6","package":"kmod-virtualbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.30-1.mga6"}]}],"bundled":8}],"products":[{"vendor":"oracle","product":"vm_virtualbox"},{"vendor":"oracle corporation","product":"vm virtualbox"}],"references":[{"url":"http://www.securityfocus.com/bid/101370","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","report"]},{"url":"http://www.securitytracker.com/id/1039599","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-10407"},{"url":"https://github.com/advisories/GHSA-544p-f4g7-j9wh"},{"url":"https://advisories.mageia.org/MGASA-2017-0390.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=21901","tags":["report"]},{"url":"https://www.virtualbox.org/wiki/Changelog-5.1#v30","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2017-10407","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-10407","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-10407","description":"Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). The supported version that is affected is Prior to 5.1.30. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox as well as unauthorized update, insert or delete access to some of Oracle VM VirtualBox accessible data and unauthorized read access to a subset of Oracle VM VirtualBox accessible data. CVSS 3.0 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H).","status":"published","published":"2017-10-19T17:00:00Z","modified":"2024-10-04T16:42:54.112Z","updated_at":"2026-11-02T14:33:12.942409Z"}],"euvd":[{"id":"EUVD-2017-2054","description":"Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). The supported version that is affected is Prior to 5.1.30. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox as well as unauthorized update, insert or delete access to some of Oracle VM VirtualBox accessible data and unauthorized read access to a subset of Oracle VM VirtualBox accessible data. CVSS 3.0 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H).","status":"published","published":"2017-10-19T17:00:00Z","modified":"2024-10-04T16:42:54Z","updated_at":"2026-11-03T00:27:51.858084Z"}],"ghsa":[{"id":"GHSA-544p-f4g7-j9wh","title":"Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core)...","description":"Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). The supported version that is affected is Prior to 5.1.30. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox as well as unauthorized update, insert or delete access to some of Oracle VM VirtualBox accessible data and unauthorized read access to a subset of Oracle VM VirtualBox accessible data. CVSS 3.0 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H).","status":"published","published":"2022-05-13T01:41:53Z","modified":"2023-02-02T05:00:45Z","cvss":[{"version":"3.0","score":7.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T14:51:02.304407Z"}],"nvd":[{"id":"CVE-2017-10407","description":"Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). The supported version that is affected is Prior to 5.1.30. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox as well as unauthorized update, insert or delete access to some of Oracle VM VirtualBox accessible data and unauthorized read access to a subset of Oracle VM VirtualBox accessible data. CVSS 3.0 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H).","status":"published","published":"2017-10-19T17:29:06.013Z","modified":"2026-06-17T01:00:22.3Z","cvss":[{"version":"3.0","score":7.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:L/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:04:03.426231Z"}],"osv":[{"id":"UBUNTU-CVE-2017-10407","description":"Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). The supported version that is affected is Prior to 5.1.30. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox as well as unauthorized update, insert or delete access to some of Oracle VM VirtualBox accessible data and unauthorized read access to a subset of Oracle VM VirtualBox accessible data. CVSS 3.0 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H).","status":"withdrawn","published":"2017-10-19T17:29:00Z","modified":"2025-07-16T08:12:46.281033Z","cvss":[{"version":"3.0","score":7.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:13.729565Z"},{"id":"MGASA-2017-0390","title":"Updated virtualbox packages fix security vulnerabilities","description":"This update provides the virtualbox 5.1.30 maintenance release, fixing\nsecurity and other issues:\n\nIn OpenSSL 1.1.0 before 1.1.0d, if a malicious server supplies bad\nparameters for a DHE or ECDHE key exchange then this can result in\nthe client attempting to dereference a NULL pointer leading to a\nclient crash. This could be exploited in a Denial of Service attack\n(CVE-2017-3730).\n\nOpenSSL is vulnerable to a denial of service, caused by an out-of-bounds\nread when using a specific cipher. By sending specially crafted truncated\npackets, a remote attacker could exploit this vulnerability using\nCHACHA20/POLY1305 to cause the application to crash (CVE-2017-3731).\n\nOpenSSL could allow a remote attacker to obtain sensitive information,\ncaused by a propagation error in the BN_mod_exp() function. An attacker\ncould exploit this vulnerability to obtain information about the private\nkey (CVE-2017-3732).\n\nDuring a renegotiation handshake if the Encrypt-Then-Mac extension is\nnegotiated where it was not in the original handshake (or vice-versa)\nthen this can cause OpenSSL 1.1.0 before 1.1.0e to crash (dependent on\nciphersuite). Both clients and servers are affected (CVE-2017-3733)\n\nA local user can exploit a flaw in the Oracle VM VirtualBox Core component\nto partially access data, partially modify data, and deny service\n(CVE-2017-10392, CVE-2017-10407, CVE-2017-10408).\n\nA local user can exploit a flaw in the Oracle VM VirtualBox Core component\nto partially access data, partially modify data, and partially deny service\n(CVE-2017-10428).\n\nFor other fixes in this update see the referenced changelog.\n","status":"published","published":"2017-10-27T07:16:04Z","modified":"2026-04-16T06:26:04.524149011Z","updated_at":"2026-11-02T15:49:40.442238Z"}]}}