{"id":"CVE-2020-2743","aliases":["EUVD-2020-22536","GHSA-gfmp-h9cc-j8h6","UBUNTU-CVE-2020-2743","openSUSE-SU-2020:0925-1"],"status":"published","title":"Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)....","description":"Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.36, prior to 6.0.16 and prior to 6.1.2. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.0 Base Score 6.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N).","severity":{"version":"3.0","score":6,"vector":"CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00563,"percentile":0.47137,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-125"],"published":"2020-04-15T13:29:44Z","modified":"2026-06-17T03:12:48Z","affected":[{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"virtualbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.4-dfsg-2","5.0.8-dfsg-1","5.0.10-dfsg-1","5.0.10-dfsg-2","5.0.10-dfsg-3","5.0.10-dfsg-4","5.0.10-dfsg-5","5.0.10-dfsg-6","5.0.10-dfsg-7","5.0.12-dfsg-1","5.0.12-dfsg-2","5.0.14-dfsg-1","5.0.14-dfsg-2","5.0.14-dfsg-2build1","5.0.16-dfsg-2","5.0.16-dfsg-3","5.0.18-dfsg-1","5.0.18-dfsg-1ubuntu1","5.0.18-dfsg-2","5.0.18-dfsg-2build1","5.0.18-dfsg-2ubuntu1","5.0.24-dfsg-0ubuntu1.16.04.1","5.0.32-dfsg-0ubuntu1.16.04.2","5.0.36-dfsg-0ubuntu1.16.04.2","5.0.40-dfsg-0ubuntu1.16.04.1","5.0.40-dfsg-0ubuntu1.16.04.2","5.1.34-dfsg-0ubuntu1.16.04.2","5.1.38-dfsg-0ubuntu1.16.04.1","5.1.38-dfsg-0ubuntu1.16.04.2","5.1.38-dfsg-0ubuntu1.16.04.3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"virtualbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.1.30-dfsg-1","5.2.0-dfsg-1build2","5.2.0-dfsg-2","5.2.0-dfsg-4","5.2.0-dfsg-5","5.2.2-dfsg-2","5.2.2-dfsg-3~build1","5.2.2-dfsg-3","5.2.4-dfsg-1","5.2.4-dfsg-2","5.2.6-dfsg-1","5.2.6-dfsg-2","5.2.6-dfsg-3","5.2.6-dfsg-3build1","5.2.6-dfsg-5","5.2.8-dfsg-2","5.2.8-dfsg-3","5.2.8-dfsg-5","5.2.8-dfsg-6","5.2.8-dfsg-7","5.2.10-dfsg-1","5.2.10-dfsg-2","5.2.10-dfsg-5","5.2.10-dfsg-6","5.2.10-dfsg-6ubuntu18.04.1","5.2.18-dfsg-2~ubuntu18.04.1","5.2.18-dfsg-2~ubuntu18.04.3","5.2.18-dfsg-2~ubuntu18.04.5","5.2.32-dfsg-0~ubuntu18.04.1","5.2.34-dfsg-0~ubuntu18.04.1","5.2.42-dfsg-0~ubuntu1.18.04.1"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"virtualbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.22-lp151.2.15.1"}]}],"bundled":19}],"products":[{"vendor":"opensuse","product":"leap"},{"vendor":"oracle","product":"vm_virtualbox"},{"vendor":"oracle corporation","product":"vm virtualbox"}],"references":[{"url":"https://www.oracle.com/security-alerts/cpuapr2020.html","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","report"]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-20-500/","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00001.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory"]},{"url":"https://security.gentoo.org/glsa/202101-09","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-2743"},{"url":"https://github.com/advisories/GHSA-gfmp-h9cc-j8h6"},{"url":"https://ubuntu.com/security/CVE-2020-2743","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-2743","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/SBBG7D2MGNFDLGBT4PUK5VBVNRBGA7XU/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1169628","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-2741","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-2742","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-2743","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-2748","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-2758","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-2894","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-2902","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-2905","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-2907","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-2908","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-2909","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-2910","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-2911","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-2913","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-2914","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-2929","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-2951","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-2958","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-2959","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2020-2743","description":"Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.36, prior to 6.0.16 and prior to 6.1.2. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.0 Base Score 6.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N).","status":"published","published":"2020-04-15T13:29:44Z","modified":"2024-09-30T15:43:39.121Z","cvss":[{"version":"3.0","score":6,"vector":"CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"updated_at":"2026-11-02T14:35:51.206854Z"}],"euvd":[{"id":"EUVD-2020-22536","description":"Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.36, prior to 6.0.16 and prior to 6.1.2. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.0 Base Score 6.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N).","status":"published","published":"2020-04-15T13:29:44Z","modified":"2024-09-30T15:43:39Z","cvss":[{"version":"3.0","score":6,"vector":"CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T00:28:03.425858Z"}],"ghsa":[{"id":"GHSA-gfmp-h9cc-j8h6","title":"Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)....","description":"Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.36, prior to 6.0.16 and prior to 6.1.2. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.0 Base Score 6.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N).","status":"published","published":"2022-05-24T17:14:48Z","modified":"2023-01-29T05:02:29Z","cwes":["CWE-125"],"updated_at":"2026-11-02T14:45:05.725997Z"}],"nvd":[{"id":"CVE-2020-2743","description":"Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.36, prior to 6.0.16 and prior to 6.1.2. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.0 Base Score 6.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N).","status":"published","published":"2020-04-15T14:15:24.17Z","modified":"2026-06-17T03:12:48.267Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"3.0","score":6,"vector":"CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:P/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:05:59.125695Z"}],"osv":[{"id":"UBUNTU-CVE-2020-2743","description":"Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.36, prior to 6.0.16 and prior to 6.1.2. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.0 Base Score 6.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N).","status":"published","published":"2020-04-15T14:15:00Z","modified":"2025-10-24T04:48:15Z","cvss":[{"version":"3.0","score":6,"vector":"CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N","level":"medium"},{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:24.541803Z"},{"id":"openSUSE-SU-2020:0925-1","title":"Security update for Virtualbox","description":"\nVirtualbox was updated to 6.0.22 (released May 15 2020 by Oracle)\n\nThis is a maintenance release. The following items were fixed and/or added:\n\nGuest Additions: Build problems fix with Oracle Linux 8.2 (Red Hat compatible kernel) / Red Hat Enterprise Linux 8.2 / CentOS 8.2 (bug #19391)\nGuest Control/VBoxManage: fix handling of multiple environment variables supplied to 'VBoxManage guestcontrol VM run' (6.1.6/6.0.20 regression; bug #19518)\n\nVersion bump to 6.0.20 (released April 14 2020 by Oracle)\n\nThis is a maintenance release. The following items were fixed and/or added:\n\n- USB: Multiple enhancements improving prformance and stability\n- VBoxManage: Multiple fixes for guestcontrol command\n- Graphics: Enhancements in 2D and 3D acceleration and rendering\n- API: Fix for exception handling bug in Python bindings\n- Linux host and guest: Support Linux kernel 5.6 (bug #19312)\n\nThis update fixes the following security issues: CVE-2020-2741, CVE-2020-2742, CVE-2020-2743, CVE-2020-2748, CVE-2020-2758, CVE-2020-2894, CVE-2020-2902, CVE-2020-2905, CVE-2020-2907, CVE-2020-2908, CVE-2020-2909, CVE-2020-2910, CVE-2020-2911, CVE-2020-2913, CVE-2020-2914, CVE-2020-2929, CVE-2020-2951, CVE-2020-2958, CVE-2020-2959 (bsc#1169628)\n","status":"published","published":"2020-07-03T12:17:20Z","modified":"2026-02-04T02:52:28.517786Z","updated_at":"2026-11-02T16:58:31.152112Z"}]}}