Oracle VM VirtualBox CVE-2017-3587 Double Free Local Memory Corruption Vulnerability
BID:97750
Info
Oracle VM VirtualBox CVE-2017-3587 Double Free Local Memory Corruption Vulnerability
| Bugtraq ID: | 97750 |
| Class: | Unknown |
| CVE: |
CVE-2017-3587 |
| Remote: | No |
| Local: | Yes |
| Published: | Apr 18 2017 12:00AM |
| Updated: | May 23 2017 04:26PM |
| Credit: | Mateusz Jurczyk of Google Project Zero. |
| Vulnerable: |
Oracle VM VirtualBox 5.1.16 Oracle VM VirtualBox 5.1.14 Oracle VM VirtualBox 5.1.10 Oracle VM VirtualBox 5.1.8 Oracle VM VirtualBox 5.0.34 Oracle VM VirtualBox 5.0.32 Oracle VM VirtualBox 5.0.28 Oracle VM VirtualBox 5.0.26 Oracle VM VirtualBox 5.0.22 Oracle VM VirtualBox 5.0.16 Oracle VM VirtualBox 5.0.14 Oracle VM VirtualBox 5.0.13 Oracle VM VirtualBox 5.0.12 Oracle VM VirtualBox 5.0.11 Oracle VM VirtualBox 5.0.10 Oracle VM VirtualBox 5.0.9 Oracle VM VirtualBox 5.0.8 Oracle VM VirtualBox 5.0.18 Oracle VM VirtualBox 5.0 |
| Not Vulnerable: |
Oracle VM VirtualBox 5.1.20 Oracle VM VirtualBox 5.0.38 |
Discussion
Oracle VM VirtualBox CVE-2017-3587 Double Free Local Memory Corruption Vulnerability
Oracle VM VirtualBox is prone to a local memory-corruption vulnerability. The 'Shared Folder' sub component is affected.
Successful exploits may allow attackers to crash the affected application, resulting in denial-of-service condition. Due to the nature of this issue, arbitrary code execution may be possible but this has not been confirmed.
This vulnerability affects the following supported versions:
Prior to 5.0.38, Prior to 5.1.20
Note: This issue was previously titled 'Oracle VM VirtualBox CVE-2017-3587 Local Security Vulnerability'. The title and technical details have been changed to better reflect the vulnerability impact.
Oracle VM VirtualBox is prone to a local memory-corruption vulnerability. The 'Shared Folder' sub component is affected.
Successful exploits may allow attackers to crash the affected application, resulting in denial-of-service condition. Due to the nature of this issue, arbitrary code execution may be possible but this has not been confirmed.
This vulnerability affects the following supported versions:
Prior to 5.0.38, Prior to 5.1.20
Note: This issue was previously titled 'Oracle VM VirtualBox CVE-2017-3587 Local Security Vulnerability'. The title and technical details have been changed to better reflect the vulnerability impact.
Exploit / POC
Oracle VM VirtualBox CVE-2017-3587 Double Free Local Memory Corruption Vulnerability
The researcher has created a proof-of-concept to demonstrate the issue. Please see the references for more information.
The researcher has created a proof-of-concept to demonstrate the issue. Please see the references for more information.
Solution / Fix
Oracle VM VirtualBox CVE-2017-3587 Double Free Local Memory Corruption Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
Oracle VM VirtualBox CVE-2017-3587 Double Free Local Memory Corruption Vulnerability
References:
References: