{"id":"CVE-2021-2145","aliases":["EUVD-2021-16604","GHSA-v3hf-m7m3-6crp","MGASA-2021-0197","UBUNTU-CVE-2021-2145","openSUSE-SU-2021:0723-1","openSUSE-SU-2021:0977-1","openSUSE-SU-2024:11501-1"],"status":"published","title":"Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The...","description":"Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.20. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.00809,"percentile":0.5714,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2021-04-22T21:53:44Z","modified":"2026-06-17T03:48:54Z","affected":[{"source":"osv","ecosystem":"Mageia:7","package":"virtualbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.20-1.mga7"}]}],"bundled":19},{"source":"osv","ecosystem":"Mageia:7","package":"kmod-virtualbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.20-1.mga7"}]}],"bundled":19},{"source":"osv","ecosystem":"Mageia:8","package":"virtualbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.20-1.1.mga8"}]}],"bundled":19},{"source":"osv","ecosystem":"Mageia:8","package":"kmod-virtualbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.20-1.1.mga8"}]}],"bundled":19},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"virtualbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.4-dfsg-2","5.0.8-dfsg-1","5.0.10-dfsg-1","5.0.10-dfsg-2","5.0.10-dfsg-3","5.0.10-dfsg-4","5.0.10-dfsg-5","5.0.10-dfsg-6","5.0.10-dfsg-7","5.0.12-dfsg-1","5.0.12-dfsg-2","5.0.14-dfsg-1","5.0.14-dfsg-2","5.0.14-dfsg-2build1","5.0.16-dfsg-2","5.0.16-dfsg-3","5.0.18-dfsg-1","5.0.18-dfsg-1ubuntu1","5.0.18-dfsg-2","5.0.18-dfsg-2build1","5.0.18-dfsg-2ubuntu1","5.0.24-dfsg-0ubuntu1.16.04.1","5.0.32-dfsg-0ubuntu1.16.04.2","5.0.36-dfsg-0ubuntu1.16.04.2","5.0.40-dfsg-0ubuntu1.16.04.1","5.0.40-dfsg-0ubuntu1.16.04.2","5.1.34-dfsg-0ubuntu1.16.04.2","5.1.38-dfsg-0ubuntu1.16.04.1","5.1.38-dfsg-0ubuntu1.16.04.2","5.1.38-dfsg-0ubuntu1.16.04.3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"virtualbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.1.30-dfsg-1","5.2.0-dfsg-1build2","5.2.0-dfsg-2","5.2.0-dfsg-4","5.2.0-dfsg-5","5.2.2-dfsg-2","5.2.2-dfsg-3~build1","5.2.2-dfsg-3","5.2.4-dfsg-1","5.2.4-dfsg-2","5.2.6-dfsg-1","5.2.6-dfsg-2","5.2.6-dfsg-3","5.2.6-dfsg-3build1","5.2.6-dfsg-5","5.2.8-dfsg-2","5.2.8-dfsg-3","5.2.8-dfsg-5","5.2.8-dfsg-6","5.2.8-dfsg-7","5.2.10-dfsg-1","5.2.10-dfsg-2","5.2.10-dfsg-5","5.2.10-dfsg-6","5.2.10-dfsg-6ubuntu18.04.1","5.2.18-dfsg-2~ubuntu18.04.1","5.2.18-dfsg-2~ubuntu18.04.3","5.2.18-dfsg-2~ubuntu18.04.5","5.2.32-dfsg-0~ubuntu18.04.1","5.2.34-dfsg-0~ubuntu18.04.1","5.2.42-dfsg-0~ubuntu1.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"virtualbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.0.14-dfsg-1","6.0.14-dfsg-2~build1","6.0.14-dfsg-2","6.1.0-dfsg-3build1","6.1.0-dfsg-3build2","6.1.2-dfsg-1","6.1.2-dfsg-1build1","6.1.4-dfsg-1","6.1.4-dfsg-2~build1","6.1.4-dfsg-2","6.1.4-dfsg-4","6.1.6-dfsg-1","6.1.10-dfsg-1~ubuntu1.20.04.1","6.1.16-dfsg-6~ubuntu1.20.04.1","6.1.16-dfsg-6~ubuntu1.20.04.2","6.1.22-dfsg-2~ubuntu1.20.04.1","6.1.26-dfsg-3~ubuntu1.20.04.1","6.1.26-dfsg-3~ubuntu1.20.04.2","6.1.32-dfsg-1~ubuntu1.20.04.1","6.1.34-dfsg-3~ubuntu1.20.04.1","6.1.38-dfsg-3~ubuntu1.20.04.1","6.1.48-dfsg-1~ubuntu1.20.04.1","6.1.50-dfsg-1~ubuntu1.20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"virtualbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.1.26-dfsg-4","6.1.28-dfsg-1","6.1.30-dfsg-1","6.1.32-dfsg-1","6.1.32-dfsg-1build1","6.1.34-dfsg-3~ubuntu1.22.04.1","6.1.38-dfsg-3~ubuntu1.22.04.1","6.1.48-dfsg-1~ubuntu1.22.04.1","6.1.50-dfsg-1~ubuntu1.22.04.1","6.1.50-dfsg-1~ubuntu1.22.04.3"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"virtualbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.22-lp152.2.24.2"}]}],"bundled":21},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"virtualbox-kmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.22-lp152.2.24.2"}]}],"bundled":21},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"virtualbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.22-lp153.2.3.2"}]}],"bundled":21},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"virtualbox-kmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.22-lp153.2.3.2"}]}],"bundled":21},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"virtualbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.26-3.2"}]}],"bundled":43}],"products":[{"vendor":"oracle","product":"vm_virtualbox"},{"vendor":"oracle corporation","product":"vm virtualbox"}],"references":[{"url":"https://www.oracle.com/security-alerts/cpuapr2021.html","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","report"]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-21-455/","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry","report"]},{"url":"https://security.gentoo.org/glsa/202208-36","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-2145"},{"url":"https://github.com/advisories/GHSA-v3hf-m7m3-6crp"},{"url":"https://advisories.mageia.org/MGASA-2021-0197.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=28828","tags":["report"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=27362","tags":["report"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=27433","tags":["report"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=27936","tags":["report"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=28734","tags":["report"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2021.html#AppendixOVIR","tags":["web"]},{"url":"https://www.virtualbox.org/wiki/Changelog","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2021-2145","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-2145","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/H2VYFQN75RCOBQFQCIU4LU7E32CGO4SK/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1182918","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-2145","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-2250","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-2264","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-2266","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-2279","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-2280","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-2281","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-2282","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-2283","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-2284","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-2285","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-2286","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-2287","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-2291","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-2296","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-2297","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-2306","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-2309","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-2310","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-2312","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25319","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/ATNJPOC23AR5PQLUDKUL5FXOOPOM3VDD/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1186361","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2017-10392","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-3316","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-3559","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-3561","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-0732","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-0739","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-11763","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-11784","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-2689","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-2694","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-2842","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-3005","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-3087","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-3288","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-3294","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-2450","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-2500","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-2501","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-2521","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-2656","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-2678","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-2722","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-2848","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-2859","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-2926","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-2984","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3028","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14628","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14673","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14677","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14700","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14703","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14713","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14715","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-2674","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-2681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-2704","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-2074","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2021-2145","description":"Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.20. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).","status":"published","published":"2021-04-22T21:53:44Z","modified":"2024-09-26T18:12:19.065Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"cna"}],"updated_at":"2026-11-02T14:33:03.671751Z"}],"euvd":[{"id":"EUVD-2021-16604","description":"Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.20. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).","status":"published","published":"2021-04-22T21:53:44Z","modified":"2024-09-26T18:12:19Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T00:28:08.503734Z"}],"ghsa":[{"id":"GHSA-v3hf-m7m3-6crp","title":"Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The...","description":"Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.20. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).","status":"published","published":"2022-05-24T17:48:41Z","modified":"2023-01-29T05:06:04Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T14:45:56.147373Z"}],"nvd":[{"id":"CVE-2021-2145","description":"Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.20. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).","status":"published","published":"2021-04-22T22:15:12.59Z","modified":"2026-06-17T03:48:54.39Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"2.0","score":4.4,"vector":"AV:L/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:06:52.03307Z"}],"osv":[{"id":"UBUNTU-CVE-2021-2145","description":"Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.20. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).","status":"published","published":"2021-04-22T22:15:00Z","modified":"2025-10-24T04:49:09Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:26.29421Z"},{"id":"MGASA-2021-0197","title":"Updated virtualbox packages fix security vulnerabilities","description":"This update provides the upstream 6.1.20 maintenance release that fixes\nat least the following security vulnerabilities:\n\nA difficult to exploit vulnerability in the Oracle VM VirtualBox\n(component: Core) prior to 6.1.20 allows high privileged attacker with\nlogon to the infrastructure where Oracle VM VirtualBox executes to\ncompromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM\nVirtualBox, attacks may significantly impact additional products.\nSuccessful attacks of this vulnerability can result in takeover of Oracle\nVM VirtualBox (CVE-2021-2145, CVE-2021-2309, CVE-2021-2310).\n\nAn easily exploitable vulnerability in the Oracle VM VirtualBox\n(component: Core) prior to 6.1.20 allows high privileged attacker\nwith logon to the infrastructure where Oracle VM VirtualBox executes\nto compromise Oracle VM VirtualBox. While the vulnerability is in Oracle\nVM VirtualBox, attacks may significantly impact additional products.\nSuccessful attacks of this vulnerability can result in takeover of Oracle\nVM VirtualBox (CVE-2021-2250).\n\nAn easily exploitable vulnerability in the Oracle VM VirtualBox\n(component: Core) prior to 6.1.20 allows low privileged attacker with\nlogon to the infrastructure where Oracle VM VirtualBox executes to\ncompromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM\nVirtualBox, attacks may significantly impact additional products.\nSuccessful attacks of this vulnerability can result in unauthorized\ncreation, deletion or modification access to critical data or all Oracle\nVM VirtualBox accessible data as well as unauthorized access to critical\ndata or complete access to all Oracle VM VirtualBox accessible data \n(CVE-2021-2264).\n\nAn easily exploitable vulnerability in the Oracle VM VirtualBox\n(component: Core) prior to 6.1.20 allows high privileged attacker with\nlogon to the infrastructure where Oracle VM VirtualBox executes to\ncompromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM\nVirtualBox, attacks may significantly impact additional products.\nSuccessful attacks of this vulnerability can result in unauthorized access\nto critical data or complete access to all Oracle VM VirtualBox accessible\ndata (CVE-2021-2266, CVE-2021-2306).\n\nA difficult to exploit vulnerability in the Oracle VM VirtualBox\n(component: Core) prior to 6.1.20 allows unauthenticated attacker with\nnetwork access via RDP to compromise Oracle VM VirtualBox. Successful\nattacks of this vulnerability can result in takeover of Oracle VM\nVirtualBox (CVE-2021-2279).\n\nAn easily exploitable vulnerability in the Oracle VM VirtualBox\n(component: Core) prior to 6.1.20 allows unauthenticated attacker with\nlogon to the infrastructure where Oracle VM VirtualBox executes to\ncompromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM\nVirtualBox, attacks may significantly impact additional products.\nSuccessful attacks of this vulnerability can result in unauthorized access\nto critical data or complete access to all Oracle VM VirtualBox accessible\ndata (CVE-2021-2280, CVE-2021-2282, CVE-2021-2283, CVE-2021-2284,\nCVE-2021-2285, CVE-2021-2287).\n\nAn easily exploitable vulnerability in the Oracle VM VirtualBox\n(component: Core) prior to 6.1.20 allows unauthenticated attacker with\nlogon to the infrastructure where Oracle VM VirtualBox executes to\ncompromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM\nVirtualBox, attacks may significantly impact additional products.\nSuccessful attacks of this vulnerability can result in unauthorized\ncreation, deletion or modification access to critical data or all Oracle\nVM VirtualBox accessible data. (CVE-2021-2281, CVE-2021-2284,\nCVE-2021-2286).\n\nAn easily exploitable vulnerability in the Oracle VM VirtualBox\n(component: Core) prior to 6.1.20 allows low privileged attacker with\nlogon to the infrastructure where Oracle VM VirtualBox executes to\ncompromise Oracle VM VirtualBox. Successful attacks of this vulnerability\ncan result in unauthorized access to critical data or complete access to\nall Oracle VM VirtualBox accessible data (CVE-2021-2291).\n\nAn easily exploitable vulnerability in the Oracle VM VirtualBox\n(component: Core) prior to 6.1.20 allows high privileged attacker with\nlogon to the infrastructure where Oracle VM VirtualBox executes to\ncompromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM\nVirtualBox, attacks may significantly impact additional products.\nSuccessful attacks of this vulnerability can result in unauthorized access\nto critical data or complete access to all Oracle VM VirtualBox accessible\ndata (CVE-2021-2296, CVE-2021-2297).\n\nThis update also fixes the following issues:\n- fixes a zombie spawning process for Virtualbox (mga#27362)\n- adds a workaround for a non-working file selection dialog with Plasma\n  (Mageia 8 only, mga#27433)\n- fixes installing the packaged Oracle VBoxDTrace Extension Pack (mga#27936)\n- removes a broken VBoxREM.so symlink that belongs to a feature not supported\n  in virtualbox 6.1 series (mga#28734).\n\nFor other upstream fixes in this update, see the referenced changelog.\n","status":"published","published":"2021-04-23T22:53:14Z","modified":"2026-04-16T04:41:45.349796601Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"openSUSE-SU-2021:0723-1","title":"Security update for virtualbox","description":"This update for virtualbox fixes the following issues:\n\nvirtualbox was updated to 6.1.22 (released April 29 2021 by Oracle)\n\nThis is a maintenance release. The following items were fixed and/or added:\n\n- VMM: Improved performance of 64-bit Windows and Solaris guests when Hyper-V is used on recent Windows 10 hosts\n- VMM: Fixed frequent crashes of 64-bit Windows Vista and Server 2003 guests when Hyper-V is used\n- GUI: Fixed regression where user was not able to save unset default shortcuts (bug #20305)\n- Storage: Fixed regression in LsiLogic SAS controller emulation caused VM crash (bug #20323)\n- Linux Guest Additions: Fixed issue when it was not possible to run executables from mounted share (bug #20320)\n- Fixes for CVE-2021-2145 CVE-2021-2250 CVE-2021-2264 CVE-2021-2266 CVE-2021-2279 CVE-2021-2280\n            CVE-2021-2281 CVE-2021-2282 CVE-2021-2283 CVE-2021-2284 CVE-2021-2285 CVE-2021-2286\n            CVE-2021-2287 CVE-2021-2291 CVE-2021-2296 CVE-2021-2297 CVE-2021-2306 CVE-2021-2309\n            CVE-2021-2310 CVE-2021-2312\n\n- Version bump to (released April 20 2021 by Oracle)\n  File 'virtualbox-kmp-files-leap' is deleted.\n- Use distconfdir for xinitrc.d files on TW\n\n- Improve autostart security boo#1182918. ","status":"published","published":"2021-10-09T08:28:18Z","modified":"2025-05-07T18:12:26.877368Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2021:0977-1","title":"Security update for virtualbox","description":"This update for virtualbox fixes the following issues:\n\n- Update vboxdrv.sh per boo#1186361\n\nVersion bump to 6.1.22 (released April 29 2021 by Oracle)\n\n- This is a maintenance release. The following items were fixed and/or added:\n- VMM: Improved performance of 64-bit Windows and Solaris guests when Hyper-V is used on recent Windows 10 hosts\n- VMM: Fixed frequent crashes of 64-bit Windows Vista and Server 2003 guests when Hyper-V is used\n- GUI: Fixed regression where user was not able to save unset default shortcuts (bug #20305)\n- Storage: Fixed regression in LsiLogic SAS controller emulation caused VM crash (bug #20323)\n- Linux Guest Additions: Fixed issue when it was not possible to run executables from mounted share (bug #20320)\n- Fixes for CVE-2021-2145 CVE-2021-2250 CVE-2021-2264 CVE-2021-2266 CVE-2021-2279 CVE-2021-2280\n            CVE-2021-2281 CVE-2021-2282 CVE-2021-2283 CVE-2021-2284 CVE-2021-2285 CVE-2021-2286\n            CVE-2021-2287 CVE-2021-2291 CVE-2021-2296 CVE-2021-2297 CVE-2021-2306 CVE-2021-2309\n            CVE-2021-2310 CVE-2021-2312\n\n- Improve autostart security boo#1182918. ","status":"published","published":"2021-10-09T08:34:52Z","modified":"2026-02-04T03:02:06.455971Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2024:11501-1","title":"python3-virtualbox-6.1.26-3.2 on GA media","description":"These are all security issues fixed in the python3-virtualbox-6.1.26-3.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:54:38.601473Z","updated_at":"2026-11-02T16:58:35.195147Z"}]}}