{"id":"CVE-2018-2687","aliases":["EUVD-2018-14542","GHSA-7pcq-f6pq-5cpf","MGASA-2018-0101","UBUNTU-CVE-2018-2687"],"status":"published","title":"Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core)...","description":"Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.1.32 and Prior to 5.2.6. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 8.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H).","severity":{"version":"3.0","score":8.6,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00531,"percentile":0.45133,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2018-01-18T02:00:00Z","modified":"2026-06-17T01:56:07Z","fixes":[{"ecosystem":"Ubuntu:20.04:LTS","package":"virtualbox","fixed_in":["6.1.16-dfsg-6~ubuntu1.20.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Mageia:6","package":"kmod-vboxadditions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.6-1.mga6"}]}],"bundled":12},{"source":"osv","ecosystem":"Mageia:6","package":"kmod-virtualbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.6-1.mga6"}]}],"bundled":12},{"source":"osv","ecosystem":"Mageia:6","package":"virtualbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.6-1.mga6"}]}],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"virtualbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.4-dfsg-2","5.0.8-dfsg-1","5.0.10-dfsg-1","5.0.10-dfsg-2","5.0.10-dfsg-3","5.0.10-dfsg-4","5.0.10-dfsg-5","5.0.10-dfsg-6","5.0.10-dfsg-7","5.0.12-dfsg-1","5.0.12-dfsg-2","5.0.14-dfsg-1","5.0.14-dfsg-2","5.0.14-dfsg-2build1","5.0.16-dfsg-2","5.0.16-dfsg-3","5.0.18-dfsg-1","5.0.18-dfsg-1ubuntu1","5.0.18-dfsg-2","5.0.18-dfsg-2build1","5.0.18-dfsg-2ubuntu1","5.0.24-dfsg-0ubuntu1.16.04.1","5.0.32-dfsg-0ubuntu1.16.04.2","5.0.36-dfsg-0ubuntu1.16.04.2","5.0.40-dfsg-0ubuntu1.16.04.1","5.0.40-dfsg-0ubuntu1.16.04.2","5.1.34-dfsg-0ubuntu1.16.04.2","5.1.38-dfsg-0ubuntu1.16.04.1","5.1.38-dfsg-0ubuntu1.16.04.2","5.1.38-dfsg-0ubuntu1.16.04.3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"virtualbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.1.30-dfsg-1","5.2.0-dfsg-1build2","5.2.0-dfsg-2","5.2.0-dfsg-4","5.2.0-dfsg-5","5.2.2-dfsg-2","5.2.2-dfsg-3~build1","5.2.2-dfsg-3","5.2.4-dfsg-1","5.2.4-dfsg-2","5.2.6-dfsg-1","5.2.6-dfsg-2","5.2.6-dfsg-3","5.2.6-dfsg-3build1","5.2.6-dfsg-5","5.2.8-dfsg-2","5.2.8-dfsg-3","5.2.8-dfsg-5","5.2.8-dfsg-6","5.2.8-dfsg-7","5.2.10-dfsg-1","5.2.10-dfsg-2","5.2.10-dfsg-5","5.2.10-dfsg-6","5.2.10-dfsg-6ubuntu18.04.1","5.2.18-dfsg-2~ubuntu18.04.1","5.2.18-dfsg-2~ubuntu18.04.3","5.2.18-dfsg-2~ubuntu18.04.5","5.2.32-dfsg-0~ubuntu18.04.1","5.2.34-dfsg-0~ubuntu18.04.1","5.2.42-dfsg-0~ubuntu1.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"virtualbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.16-dfsg-6~ubuntu1.20.04.1"}]}],"versions":["6.0.14-dfsg-1","6.0.14-dfsg-2~build1","6.0.14-dfsg-2","6.1.0-dfsg-3build1","6.1.0-dfsg-3build2","6.1.2-dfsg-1","6.1.2-dfsg-1build1","6.1.4-dfsg-1","6.1.4-dfsg-2~build1","6.1.4-dfsg-2","6.1.4-dfsg-4","6.1.6-dfsg-1","6.1.10-dfsg-1~ubuntu1.20.04.1"]}],"products":[{"vendor":"oracle","product":"vm_virtualbox"},{"vendor":"oracle corporation","product":"vm virtualbox"}],"references":[{"url":"http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","report"]},{"url":"http://www.securitytracker.com/id/1040202","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://www.securityfocus.com/bid/102691","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-2687"},{"url":"https://github.com/advisories/GHSA-7pcq-f6pq-5cpf"},{"url":"https://advisories.mageia.org/MGASA-2018-0101.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=22408","tags":["report"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html#AppendixOVIR","tags":["advisory"]},{"url":"https://www.virtualbox.org/wiki/Changelog","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2018-2687","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-2687","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2018-2687","description":"Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.1.32 and Prior to 5.2.6. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 8.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H).","status":"published","published":"2018-01-18T02:00:00Z","modified":"2024-10-03T20:32:43.91Z","updated_at":"2026-11-02T14:35:04.911021Z"}],"euvd":[{"id":"EUVD-2018-14542","description":"Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.1.32 and Prior to 5.2.6. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 8.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H).","status":"published","published":"2018-01-18T02:00:00Z","modified":"2024-10-03T20:32:43Z","updated_at":"2026-11-03T00:27:52.849961Z"}],"ghsa":[{"id":"GHSA-7pcq-f6pq-5cpf","title":"Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core)...","description":"Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.1.32 and Prior to 5.2.6. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 8.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H).","status":"published","published":"2022-05-13T01:51:25Z","modified":"2023-02-02T05:02:07Z","cvss":[{"version":"3.0","score":8.6,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T14:51:21.252342Z"}],"nvd":[{"id":"CVE-2018-2687","description":"Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.1.32 and Prior to 5.2.6. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 8.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H).","status":"published","published":"2018-01-18T02:29:23.117Z","modified":"2026-06-17T01:56:07.293Z","cvss":[{"version":"3.0","score":8.6,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":4.4,"vector":"AV:L/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:04:22.309028Z"}],"osv":[{"id":"UBUNTU-CVE-2018-2687","description":"Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.1.32 and Prior to 5.2.6. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 8.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H).","status":"published","published":"2018-01-18T02:29:00Z","modified":"2025-10-24T04:46:45Z","cvss":[{"version":"3.0","score":8.6,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:17.91743Z"},{"id":"MGASA-2018-0101","title":"Updated virtualbox packages fix security vulnerabilities","description":"Oracle VM VirtualBox incorporate the OpenSSL software libraries to provide\ncryptographic capabilities. OpenSSL versions through 1.0.2m and 1.1.0g are\nsusceptible to a vulnerability that could allow an attacker to recover\nencryption keys and access protected communications (CVE-2017-3736).\n\nSystems with microprocessors utilizing speculative execution and indirect\nbranch prediction may allow unauthorized disclosure of information to an\nattacker with local user access via a side-channel analysis (CVE-2017-5715).\n\nOracle VM VirtualBox prior to 5.2.6 has easily exploitable vulnerabilities\nthat allows high privileged attacker with logon to the infrastructure where\nVirtualBox executes to compromise it. While the vulnerability is in \nVirtualBox, attacks may significantly impact additional products. Successful\nattacks of this vulnerability can result in takeover of VirtualBox  \n(CVE-2018-2676).\n\nOracle VM VirtualBox prior to 5.2.6 has easily exploitable vulnerabilities\nthat allows unauthenticated attacker with logon to the infrastructure where\nVirtualBox executes to compromise it. Successful attacks require human\ninteraction from a person other than the attacker and while the\nvulnerability is in VirtualBox, attacks may significantly impact additional\nproducts. Successful attacks of this vulnerability can result in takeover\nof VirtualBox (CVE-2018-2685, CVE-2018-2686, CVE-2018-2687, CVE-2018-2688,\nCVE-2018-2689, CVE-2018-2690).\n\nOracle VM VirtualBox Guest Additions prior to 5.2.6 has an easily exploitable\nvulnerability allows low privileged attacker with logon to the infrastructure\nwhere VirtualBox executes to compromise it. Successful attacks require human\ninteraction from a person other than the attacker and while the vulnerability\nis in VirtualBox, attacks may significantly impact additional products.\nSuccessful attacks of this vulnerability can result in takeover of VirtualBox\n(CVE-2018-2693).\n\nOracle VM VirtualBox prior to 5.2.6 has easily exploitable vulnerabilities\nthat allows low privileged attacker with logon to the infrastructure where\nVirtualBox executes to compromise it. While the vulnerability is in \nVirtualBox, attacks may significantly impact additional products. Successful\nattacks of this vulnerability can result in takeover of VirtualBox\n(CVE-2018-2694, CVE-2018-2698).\n\nFor other fixes in this update, see the referenced changelog.\n","status":"published","published":"2018-01-25T21:04:19Z","modified":"2026-04-16T06:23:03.076946793Z","updated_at":"2026-11-02T15:49:40.442238Z"}]}}