CVE-2012-3221

NameCVE-2012-3221
DescriptionUnspecified vulnerability in the Oracle VM Virtual Box component in Oracle Virtualization 3.2, 4.0, and 4.1 allows local users to affect availability via unknown vectors related to VirtualBox Core. NOTE: The previous information was obtained from the October 2012 CPU. Oracle has not commented on claims from another vendor that this issue is related to "incorrect interrupt handling."
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, GitHub code/issues, web search, more)
ReferencesDSA-2594-1
NVD severitylow (attack range: local)
Debian Bugs690777

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
virtualbox (PTS)jessie/contrib (security), jessie/contrib4.3.36-dfsg-1+deb8u1fixed
stretch/contrib5.0.24-dfsg-2fixed
sid/contrib5.1.4-dfsg-1fixed
wheezy (security), wheezy4.1.42-dfsg-1+deb7u1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
virtualboxsource(unstable)4.1.18-dfsg-1.1low690777
virtualbox-osesource(unstable)(unfixed)low
virtualbox-osesourcesqueeze3.2.10-dfsg-1+squeeze1lowDSA-2594-1

Notes

http://www.halfdog.net/Security/2012/VirtualBoxSoftwareInterrupt0x8GuestCrash/

Search for package or bug name: Reporting problems