openSUSE-SU-2023:0351-1: important: Security update for virtualbox
openSUSE Security Update: Security update for virtualbox
_______________________________
Announcement ID: openSUSE-SU-2023:0351-1
Rating: important
References: #1216363 #1216364 #1216365
Cross-References: CVE-2023-22098 CVE-2023-22099 CVE-2023-22100
CVSS scores:
CVE-2023-22098 (NVD) : 7.3 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H
CVE-2023-22098 (SUSE): 7.3 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H
CVE-2023-22099 (NVD) : 8.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVE-2023-22099 (SUSE): 7.3 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H
CVE-2023-22100 (NVD) : 7.9 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:H
CVE-2023-22100 (SUSE): 7.9 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:H
Affected Products:
openSUSE Leap 15.4
_______________________________
An update that fixes three vulnerabilities is now available.
Description:
This update for virtualbox fixes the following issues:
- Version bump to VirtualBox 7.0.12 (released October 17 2023 by Oracle)
Fixes the following:
- CVE-2023-22098 (boo#1216363)
- CVE-2023-22099 (boo#1216364)
- CVE-2023-22100 (boo#1216365)
This is a maintenance release. The following items were fixed and/or added:
- VMM: Fixed using a debugger inside the guest under certain circumstances
(bugs #21413 and #21546)
- VMM: Fixed detection of VT-x being used by other hypervisors (bug #21867)
- VMM: Introduced additional improvements in Split Lock Detection feature
of recent Intel CPUs on Linux hosts (bug #20180)
- GUI: Fixed issue when the nested hardware virtualization setting was not
displayed in the VM details panel (bug #21707)
- GUI: Introduced NLS update for Croatian, Indonesian, Italian, Japanese,
Korean, Dutch and Turkish languages as well as added general
look-and-feel improvements
- Devices: Fixed black screen in Windows guests with multiple guest
screens when 3D is disabled (7.0.10 regression)
- Devices: Fixed PCI device identifiers for the VirtIO network interface
(bug #21516)
- Devices: Fixed VLAN support for the VirtIO network interface (bug #21778)
- Devices: Fixed loading saved states when a TPM is configured (7.0.10
regression, bug #21773)
- Networking: Fixed memory leaks in the VBoxIntNetSwitch process on macOS
(bug #21752)
- Networking: Fixed TCP connections with IP addresses ending on .2 when
the NAT network attachment is used (bug #21513)
- VRDP: Added general improvements
- VBoxManage: Added improvements for "list usbfilters" command
- Unattended: Added kick start file support for Oracle Linux 8 and Oracle
Linux 9.
- Main: Added more Linux OS subtypes
- Host Services: Fixed Guest Properties service crash under rare
circumstance
- Linux Host and Guest: Fixed few "field-spanning write" kernel warnings
(bugs #21410 and #21862)
- Linux Guest Additions: Added more fixes for RHEL 8.9 and 9.3 kernel
- Linux Guest Additions: Added more fixes for kernel 6.4
- Linux Guest Additions: Added initial support for OpenSUSE 15.5 kernel
- Linux Guest Additions: Added initial support for kernels 6.5 and 6.6
- Linux Guest Additions: Added version reporting for "rcvboxadd
status-kernel" and "rcvboxadd status-user" commands
- BIOS: Restored support for ISA SCSI HBAs in the BIOS (bug #21736)
- Convert to systemd-sysusers
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 15.4:
zypper in -t patch openSUSE-2023-351=1
Package List:
- openSUSE Leap 15.4 (x86_64):
python3-virtualbox-7.0.12-lp154.2.43.1
python3-virtualbox-debuginfo-7.0.12-lp154.2.43.1
virtualbox-7.0.12-lp154.2.43.1
virtualbox-debuginfo-7.0.12-lp154.2.43.1
virtualbox-debugsource-7.0.12-lp154.2.43.1
virtualbox-devel-7.0.12-lp154.2.43.1
virtualbox-guest-tools-7.0.12-lp154.2.43.1
virtualbox-guest-tools-debuginfo-7.0.12-lp154.2.43.1
virtualbox-kmp-debugsource-7.0.12-lp154.2.43.1
virtualbox-kmp-default-7.0.12_k5.14.21_150400.24.92-lp154.2.43.1
virtualbox-kmp-default-debuginfo-7.0.12_k5.14.21_150400.24.92-lp154.2.43.1
virtualbox-qt-7.0.12-lp154.2.43.1
virtualbox-qt-debuginfo-7.0.12-lp154.2.43.1
virtualbox-vnc-7.0.12-lp154.2.43.1
virtualbox-websrv-7.0.12-lp154.2.43.1
virtualbox-websrv-debuginfo-7.0.12-lp154.2.43.1
- openSUSE Leap 15.4 (noarch):
virtualbox-guest-desktop-icons-7.0.12-lp154.2.43.1
virtualbox-guest-source-7.0.12-lp154.2.43.1
virtualbox-host-source-7.0.12-lp154.2.43.1
References:
https://www.suse.com/security/cve/CVE-2023-22098.html
https://www.suse.com/security/cve/CVE-2023-22099.html
https://www.suse.com/security/cve/CVE-2023-22100.html
https://bugzilla.suse.com/1216363
https://bugzilla.suse.com/1216364
https://bugzilla.suse.com/1216365
A virtualbox security update has been released for openSUSE Leap 15.4.
