製品・ソフトウェアに関する情報

JVN脆弱性詳細

Oracle Virtualization の VirtualBox における Core の処理に関する脆弱性

Title	Oracle Virtualization の VirtualBox における Core の処理に関する脆弱性
Summary	Oracle Virtualization の VirtualBox は、Core に関する処理に不備があるため、完全性、可用性に影響のある脆弱性が存在します。
Possible impacts	ローカルユーザにより、情報を改ざんされたり、サービス運用妨害 (DoS) 攻撃が行われる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Jan. 15, 2013, midnight
Registration Date	Jan. 18, 2013, 4:19 p.m.
Last Update	Nov. 8, 2013, 11:56 a.m.

Affected System

オラクル

Oracle Virtualization 4.0

Oracle Virtualization 4.1

Oracle Virtualization 4.2

Oracle VM VirtualBox 4.0

Oracle VM VirtualBox 4.1

Oracle VM VirtualBox 4.2

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2013-0420	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0420
National Vulnerability Database (NVD)
2	CVE-2013-0420	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-0420

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-noinfo	https://www.ipa.go.jp/security/vuln/CWE.html#CWEnoinfo

ベンダー情報

No	Name	URL
Bugzilla
1	Bug 798776	https://bugzilla.novell.com/show_bug.cgi?id=798776
opensuse-updates
2	openSUSE-SU-2013:0231	http://lists.opensuse.org/opensuse-updates/2013-02/msg00000.html
Oracle Critical Patch Update
3	Oracle Critical Patch Update Advisory - January 2013	http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html
4	Text Form of Oracle Critical Patch Update - January 2013 Risk Matrices	http://www.oracle.com/technetwork/topics/security/cpujan2013verbose-1897756.html
Security Advisories
5	MDVSA-2013:150	http://www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2013:150/?name=MDVSA-2013:150
SECURITY BLOG
6	January 2013 Critical Patch Update Released	https://blogs.oracle.com/security/entry/january_2013_critical_patch_update

Change Log

No	Changed Details	Date of change
0	[2013年01月18日] 掲載 [2013年02月28日] ベンダ情報：Novell (openSUSE-SU-2013:0231) を追加 [2013年11月08日] ベンダ情報：Mandriva, Inc. (MDVSA-2013:150) を追加ベンダ情報：Novell (openSUSE-SU-2013:0231) を追加ベンダ情報：Novell (Bug 798776) を追加	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2013-0420

Summary	Unspecified vulnerability in the VirtualBox component in Oracle Virtualization 4.0, 4.1, and 4.2 allows local users to affect integrity and availability via unknown vectors related to Core. NOTE: The previous information was obtained from the January 2013 Oracle CPU. Oracle has not commented on claims from another vendor that this issue is related to an incorrect comparison in the vga_draw_text function in Devices/Graphics/DevVGA.cpp, which can cause VirtualBox to "draw more lines than necessary."
Publication Date	Jan. 17, 2013, 10:55 a.m.
Registration Date	Jan. 26, 2021, 3:33 p.m.
Last Update	Nov. 21, 2024, 10:47 a.m.

Affected software configurations

Related information, measures and tools

No	URL	タグ
1	http://lists.opensuse.org/opensuse-updates/2013-02/msg00000.html	Vendor Advisory
2	http://lists.opensuse.org/opensuse-updates/2013-02/msg00000.html	Vendor Advisory
3	http://www.mandriva.com/security/advisories?name=MDVSA-2013:150
4	http://www.mandriva.com/security/advisories?name=MDVSA-2013:150
5	http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html	Vendor Advisory
6	http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html	Vendor Advisory
7	https://bugzilla.novell.com/show_bug.cgi?id=798776	Patch
8	https://bugzilla.novell.com/show_bug.cgi?id=798776	Patch
9	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15763
10	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15763
11	https://www.virtualbox.org/changeset/44055/vbox	Exploit Patch
12	https://www.virtualbox.org/changeset/44055/vbox	Exploit Patch

Common Vulnerabilities List