{"id":"CVE-2018-3309","aliases":["EUVD-2018-15163","GHSA-5prq-xj94-2jrc","UBUNTU-CVE-2018-3309","openSUSE-SU-2019:1547-1"],"status":"published","title":"Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core)...","description":"Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). The supported version that is affected is prior to 5.2.22. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).","severity":{"version":"3.0","score":8.2,"vector":"CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00529,"percentile":0.45036,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2019-01-16T19:00:00Z","modified":"2026-06-17T01:57:27Z","affected":[{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"virtualbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.4-dfsg-2","5.0.8-dfsg-1","5.0.10-dfsg-1","5.0.10-dfsg-2","5.0.10-dfsg-3","5.0.10-dfsg-4","5.0.10-dfsg-5","5.0.10-dfsg-6","5.0.10-dfsg-7","5.0.12-dfsg-1","5.0.12-dfsg-2","5.0.14-dfsg-1","5.0.14-dfsg-2","5.0.14-dfsg-2build1","5.0.16-dfsg-2","5.0.16-dfsg-3","5.0.18-dfsg-1","5.0.18-dfsg-1ubuntu1","5.0.18-dfsg-2","5.0.18-dfsg-2build1","5.0.18-dfsg-2ubuntu1","5.0.24-dfsg-0ubuntu1.16.04.1","5.0.32-dfsg-0ubuntu1.16.04.2","5.0.36-dfsg-0ubuntu1.16.04.2","5.0.40-dfsg-0ubuntu1.16.04.1","5.0.40-dfsg-0ubuntu1.16.04.2","5.1.34-dfsg-0ubuntu1.16.04.2","5.1.38-dfsg-0ubuntu1.16.04.1","5.1.38-dfsg-0ubuntu1.16.04.2","5.1.38-dfsg-0ubuntu1.16.04.3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"virtualbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.1.30-dfsg-1","5.2.0-dfsg-1build2","5.2.0-dfsg-2","5.2.0-dfsg-4","5.2.0-dfsg-5","5.2.2-dfsg-2","5.2.2-dfsg-3~build1","5.2.2-dfsg-3","5.2.4-dfsg-1","5.2.4-dfsg-2","5.2.6-dfsg-1","5.2.6-dfsg-2","5.2.6-dfsg-3","5.2.6-dfsg-3build1","5.2.6-dfsg-5","5.2.8-dfsg-2","5.2.8-dfsg-3","5.2.8-dfsg-5","5.2.8-dfsg-6","5.2.8-dfsg-7","5.2.10-dfsg-1","5.2.10-dfsg-2","5.2.10-dfsg-5","5.2.10-dfsg-6","5.2.10-dfsg-6ubuntu18.04.1","5.2.18-dfsg-2~ubuntu18.04.1","5.2.18-dfsg-2~ubuntu18.04.3","5.2.18-dfsg-2~ubuntu18.04.5","5.2.32-dfsg-0~ubuntu18.04.1","5.2.34-dfsg-0~ubuntu18.04.1","5.2.42-dfsg-0~ubuntu1.18.04.1"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"virtualbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.24-lp150.4.33.1"}]}],"bundled":30}],"products":[{"vendor":"oracle","product":"vm_virtualbox"},{"vendor":"oracle corporation","product":"vm virtualbox"}],"references":[{"url":"http://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","report"]},{"url":"http://www.securityfocus.com/bid/106572","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00030.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-3309"},{"url":"https://github.com/advisories/GHSA-5prq-xj94-2jrc"},{"url":"https://ubuntu.com/security/CVE-2018-3309","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-3309","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/YLQFCLW7556SZJCWGWKR74FS7FGGTK7J/#YLQFCLW7556SZJCWGWKR74FS7FGGTK7J","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1122212","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-0734","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-11763","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-11784","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-3309","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-2446","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-2448","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-2450","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-2451","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-2500","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-2501","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-2504","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-2505","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-2506","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-2508","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-2509","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-2511","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-2520","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-2521","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-2522","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-2523","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-2524","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-2525","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-2526","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-2527","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-2548","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-2552","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-2553","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-2554","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-2555","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-2556","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-3309","description":"Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). The supported version that is affected is prior to 5.2.22. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).","status":"published","published":"2019-01-16T19:00:00Z","modified":"2024-10-02T16:25:04.173Z","updated_at":"2026-11-02T14:35:05.262903Z"}],"euvd":[{"id":"EUVD-2018-15163","description":"Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). The supported version that is affected is prior to 5.2.22. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).","status":"published","published":"2019-01-16T19:00:00Z","modified":"2024-10-02T16:25:04Z","updated_at":"2026-11-03T00:27:57.62634Z"}],"ghsa":[{"id":"GHSA-5prq-xj94-2jrc","title":"Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core)...","description":"Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). The supported version that is affected is prior to 5.2.22. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).","status":"published","published":"2022-05-13T01:52:32Z","modified":"2023-02-02T05:02:13Z","cvss":[{"version":"3.0","score":8.2,"vector":"CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T14:51:23.375018Z"}],"nvd":[{"id":"CVE-2018-3309","description":"Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). The supported version that is affected is prior to 5.2.22. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).","status":"published","published":"2019-01-16T19:29:36.517Z","modified":"2026-06-17T01:57:27.14Z","cvss":[{"version":"3.0","score":8.2,"vector":"CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":4.6,"vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:04:53.079938Z"}],"osv":[{"id":"UBUNTU-CVE-2018-3309","description":"Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). The supported version that is affected is prior to 5.2.22. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).","status":"published","published":"2019-01-16T19:29:00Z","modified":"2025-10-24T04:46:47Z","cvss":[{"version":"3.0","score":8.2,"vector":"CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:18.33562Z"},{"id":"openSUSE-SU-2019:1547-1","title":"Security update for virtualbox","description":"This update for virtualbox to version 5.2.24 fixes the following issues:\n\nMultiple security issues fixed: \n\n  CVE-2019-2500, CVE-2019-2524, CVE-2019-2552, CVE-2018-3309, CVE-2019-2520\n  CVE-2019-2521, CVE-2019-2522, CVE-2019-2523, CVE-2019-2526, CVE-2019-2548\n  CVE-2018-11763, CVE-2019-2511, CVE-2019-2508, CVE-2019-2509, CVE-2019-2527 \n  CVE-2019-2450, CVE-2019-2451, CVE-2019-2555, CVE-2019-2554, CVE-2019-2556 \n  CVE-2018-11784, CVE-2018-0734, CVE-2019-2525, CVE-2019-2446, CVE-2019-2448 \n  CVE-2019-2501, CVE-2019-2504, CVE-2019-2505, CVE-2019-2506, and CVE-2019-2553 (bsc#1122212).\n\nOther issues fixed:\n\n- Linux Additions: fix for building vboxvideo on EL 7.6 standard kernel, contributed by Robert Conde\n- USB: fixed a problem causing failures attaching SuperSpeed devices which report USB version 3.1 (rather than 3.0) on Windows hosts\n- Audio: added support for surround speaker setups used by Windows 10 Build 1809\n- Linux hosts: fixed conflict between Debian and Oracle build desktop files \n- Linux guests: fixed building drivers on SLES 12.4\n- Linux guests: fixed building shared folder driver with older kernels\n","status":"published","published":"2019-06-11T15:34:36Z","modified":"2026-02-04T04:30:01.059231Z","updated_at":"2026-11-02T16:58:30.784344Z"}]}}