CVE-2016-0602

Published on: 01/20/2016 12:00:00 AM UTC

Last Modified on: 03/23/2021 11:27:12 PM UTC

CVE-2016-0602

Certain versions of Vm Virtualbox from Oracle contain the following vulnerability:

Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox before 5.0.14 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Windows Installer. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is an untrusted search path issue that allows local users to gain privileges via a Trojan horse dll in the "application directory."

CVE-2016-0602 has been assigned by [email protected] to track the vulnerability

CVSS2 Score: 6.2 - MEDIUM

Access Vector^ⓘ	Access Complexity	Authentication
LOCAL	HIGH	NONE
Confidentiality Impact	Integrity Impact	Availability Impact
COMPLETE	COMPLETE	COMPLETE

CVE References

Description	Tags ^ⓘ	Link
Oracle VM VirtualBox Flaws Let Remote or Local Users Partially Deny Service and Local Users Gain Elevated Privileges - SecurityTracker	www.securitytracker.com text/html	SECTRACK 1034731
SecurityFocus	www.securityfocus.com text/html	BUGTRAQ 20160205 [CVE-2016-0602, CVE-2016-0603] Executable installers are vulnerable^WEVIL (case 24): Oracle Java 6/7/8 SE and VirtualBox
Full Disclosure: [CVE-2016-0602, CVE-2016-0603] Executable installers are vulnerable^WEVIL (case 24): Oracle Java 6/7/8 SE and VirtualBox	seclists.org text/html	FULLDISC 20160210 [CVE-2016-0602, CVE-2016-0603] Executable installers are vulnerable^WEVIL (case 24): Oracle Java 6/7/8 SE and VirtualBox
Oracle Critical Patch Update - January 2016	Patch Vendor Advisory www.oracle.com text/html	CONFIRM www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].

There are currently no QIDs associated with this CVE

Known Affected Configurations (CPE V2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Application	Oracle	Vm Virtualbox	All	All	All	All

cpe:2.3:a:oracle:vm_virtualbox:*:*:*:*:*:*:*:*:

No vendor comments have been submitted for this CVE