<?xml version="1.0" encoding="UTF-8"?>
<cvrfdoc xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:cvrf="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf" xmlns:cvrf-common="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/common" xmlns:cvssv2="http://scap.nist.gov/schema/cvss-v2/1.0" xmlns:cvssv3="https://www.first.org/cvss/cvss-v3.0.xsd" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:ns0="http://purl.org/dc/elements/1.1/" xmlns:prod="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod" xmlns:scap-core="http://scap.nist.gov/schema/scap-core/1.0" xmlns:sch="http://purl.oclc.org/dsdl/schematron" xmlns:vuln="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf">
  <DocumentTitle xml:lang="en">Security update for virtualbox</DocumentTitle>
  <DocumentType>SUSE Patch</DocumentType>
  <DocumentPublisher Type="Vendor">
    <ContactDetails>security@suse.de</ContactDetails>
    <IssuingAuthority>SUSE Security Team</IssuingAuthority>
  </DocumentPublisher>
  <DocumentTracking>
    <Identification>
      <ID>openSUSE-SU-2015:1400-1</ID>
    </Identification>
    <Status>Final</Status>
    <Version>1</Version>
    <RevisionHistory>
      <Revision>
        <Number>1</Number>
        <Date>2015-08-10T09:25:14Z</Date>
        <Description>current</Description>
      </Revision>
    </RevisionHistory>
    <InitialReleaseDate>2015-08-10T09:25:14Z</InitialReleaseDate>
    <CurrentReleaseDate>2015-08-10T09:25:14Z</CurrentReleaseDate>
    <Generator>
      <Engine>cve-database/bin/generate-cvrf.pl</Engine>
      <Date>2017-02-24T01:00:00Z</Date>
    </Generator>
  </DocumentTracking>
  <DocumentNotes>
    <Note Title="Topic" Type="Summary" Ordinal="1" xml:lang="en">Security update for virtualbox</Note>
    <Note Title="Details" Type="General" Ordinal="2" xml:lang="en">
- Version bump to 4.2.32 bnc#938408 CVE-2015-2594
  * Storage: fixed a crash when taking snapshots (4.2.30 regression)
  * ExtPack: don't fail if the TMP directory contains non-latin1 characters (bug #14159)
  * Main: implemented dedicated event processing queue
  * Linux hosts: fixed a bug which made the netfilter driver ignore certain events (bug #12264) 

Also included from Version bump to 4.2.30 bnc#935900 CVE-2015-3456:
  * Various small fixes here and there
- Fix the multiinstall on kernel modules to avoid conflicts bnc#925663
- Drop smap.diff fails to apply to the latest release


 </Note>
    <Note Title="Terms of Use" Type="Legal Disclaimer" Ordinal="3" xml:lang="en">The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).</Note>
  </DocumentNotes>
  <DocumentDistribution xml:lang="en">Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0)</DocumentDistribution>
  <DocumentReferences>
    <Reference Type="Self">
      <URL>https://lists.opensuse.org/opensuse-updates/2015-08/msg00021.html</URL>
      <Description>E-Mail link for openSUSE-SU-2015:1400-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/security/rating/</URL>
      <Description>SUSE Security Ratings</Description>
    </Reference>
  </DocumentReferences>
  <ProductTree xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod">
    <Branch Type="Product Version" Name="python-virtualbox-4.2.32-2.35.1">
      <FullProductName ProductID="python-virtualbox-4.2.32-2.35.1">python-virtualbox-4.2.32-2.35.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="virtualbox-4.2.32-2.35.1">
      <FullProductName ProductID="virtualbox-4.2.32-2.35.1">virtualbox-4.2.32-2.35.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="virtualbox-devel-4.2.32-2.35.1">
      <FullProductName ProductID="virtualbox-devel-4.2.32-2.35.1">virtualbox-devel-4.2.32-2.35.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="virtualbox-guest-kmp-default-4.2.32_k3.11.10_29-2.35.1">
      <FullProductName ProductID="virtualbox-guest-kmp-default-4.2.32_k3.11.10_29-2.35.1">virtualbox-guest-kmp-default-4.2.32_k3.11.10_29-2.35.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="virtualbox-guest-kmp-desktop-4.2.32_k3.11.10_29-2.35.1">
      <FullProductName ProductID="virtualbox-guest-kmp-desktop-4.2.32_k3.11.10_29-2.35.1">virtualbox-guest-kmp-desktop-4.2.32_k3.11.10_29-2.35.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="virtualbox-guest-kmp-pae-4.2.32_k3.11.10_29-2.35.1">
      <FullProductName ProductID="virtualbox-guest-kmp-pae-4.2.32_k3.11.10_29-2.35.1">virtualbox-guest-kmp-pae-4.2.32_k3.11.10_29-2.35.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="virtualbox-guest-tools-4.2.32-2.35.1">
      <FullProductName ProductID="virtualbox-guest-tools-4.2.32-2.35.1">virtualbox-guest-tools-4.2.32-2.35.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="virtualbox-guest-x11-4.2.32-2.35.1">
      <FullProductName ProductID="virtualbox-guest-x11-4.2.32-2.35.1">virtualbox-guest-x11-4.2.32-2.35.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="virtualbox-host-kmp-default-4.2.32_k3.11.10_29-2.35.1">
      <FullProductName ProductID="virtualbox-host-kmp-default-4.2.32_k3.11.10_29-2.35.1">virtualbox-host-kmp-default-4.2.32_k3.11.10_29-2.35.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="virtualbox-host-kmp-desktop-4.2.32_k3.11.10_29-2.35.1">
      <FullProductName ProductID="virtualbox-host-kmp-desktop-4.2.32_k3.11.10_29-2.35.1">virtualbox-host-kmp-desktop-4.2.32_k3.11.10_29-2.35.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="virtualbox-host-kmp-pae-4.2.32_k3.11.10_29-2.35.1">
      <FullProductName ProductID="virtualbox-host-kmp-pae-4.2.32_k3.11.10_29-2.35.1">virtualbox-host-kmp-pae-4.2.32_k3.11.10_29-2.35.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="virtualbox-host-source-4.2.32-2.35.1">
      <FullProductName ProductID="virtualbox-host-source-4.2.32-2.35.1">virtualbox-host-source-4.2.32-2.35.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="virtualbox-qt-4.2.32-2.35.1">
      <FullProductName ProductID="virtualbox-qt-4.2.32-2.35.1">virtualbox-qt-4.2.32-2.35.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="virtualbox-websrv-4.2.32-2.35.1">
      <FullProductName ProductID="virtualbox-websrv-4.2.32-2.35.1">virtualbox-websrv-4.2.32-2.35.1</FullProductName>
    </Branch>
  </ProductTree>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="1">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 4.0.32, 4.1.40, 4.2.32, and 4.3.30 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Core.</Note>
    </Notes>
    <CVE>CVE-2015-2594</CVE>
    <ProductStatuses>
      <Status Type="Fixed"/>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>6.6</BaseScoreV2>
        <VectorV2>AV:L/AC:M/Au:S/C:C/I:C/A:C</VectorV2>
      </ScoreSetV2>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">Please Install the update.</Description>
        <URL>https://lists.opensuse.org/opensuse-updates/2015-08/msg00021.html</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2015-2594.html</URL>
        <Description>CVE-2015-2594</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/938408</URL>
        <Description>SUSE Bug 938408</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="2">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a denial of service (out-of-bounds write and guest crash) or possibly execute arbitrary code via the (1) FD_CMD_READ_ID, (2) FD_CMD_DRIVE_SPECIFICATION_COMMAND, or other unspecified commands, aka VENOM.</Note>
    </Notes>
    <CVE>CVE-2015-3456</CVE>
    <ProductStatuses>
      <Status Type="Fixed"/>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>7.7</BaseScoreV2>
        <VectorV2>AV:A/AC:L/Au:S/C:C/I:C/A:C</VectorV2>
      </ScoreSetV2>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">Please Install the update.</Description>
        <URL>https://lists.opensuse.org/opensuse-updates/2015-08/msg00021.html</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2015-3456.html</URL>
        <Description>CVE-2015-3456</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/929339</URL>
        <Description>SUSE Bug 929339</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/932770</URL>
        <Description>SUSE Bug 932770</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/935900</URL>
        <Description>SUSE Bug 935900</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
</cvrfdoc>
