CVE-2012-3221

NameCVE-2012-3221
DescriptionUnspecified vulnerability in the Oracle VM Virtual Box component in Oracle Virtualization 3.2, 4.0, and 4.1 allows local users to affect availability via unknown vectors related to VirtualBox Core. NOTE: The previous information was obtained from the October 2012 CPU. Oracle has not commented on claims from another vendor that this issue is related to "incorrect interrupt handling."
SourceCVE (at NVD; oss-sec, fulldisc, OSVDB, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, more)
ReferencesDSA-2594-1
NVD severitylow (attack range: local)
Debian Bugs690777
Debian/oldstablenot vulnerable.
Debian/stablenot vulnerable.
Debian/testingnot vulnerable.
Debian/unstablenot vulnerable.

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
virtualbox (PTS)sid/contrib, jessie/contrib4.3.18-dfsg-3fixed
wheezy4.1.18-dfsg-2+deb7u3fixed
wheezy (security)4.1.18-dfsg-2+deb7u4fixed
virtualbox-ose (PTS)squeeze (security), squeeze3.2.10-dfsg-1+squeeze3fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
virtualboxsource(unstable)4.1.18-dfsg-1.1low690777
virtualbox-osesource(unstable)(unfixed)low
virtualbox-osesourcesqueeze3.2.10-dfsg-1+squeeze1lowDSA-2594-1

Notes

http://www.halfdog.net/Security/2012/VirtualBoxSoftwareInterrupt0x8GuestCrash/

Search for package or bug name: Reporting problems