ByteOS Network

Vulnerability Details :

CVE-2019-2875

Assigner-oracle

Assigner Org ID-43595867-4340-4103-b7a2-9a5208d29a85

Published At-23 Jul, 2019 | 22:31

Updated At-01 Oct, 2024 | 16:34

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.2.32 and prior to 6.0.10. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle VM VirtualBox. CVSS 3.0 Base Score 3.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:oracle

Assigner Org ID:43595867-4340-4103-b7a2-9a5208d29a85

Published At:23 Jul, 2019 | 22:31

Updated At:01 Oct, 2024 | 16:34

▼CVE Numbering Authority (CNA)

Affected Products

Vendor

Oracle Corporation

Product

VM VirtualBox

Versions

Affected

From unspecified before 5.2.32 (custom)
From unspecified before 6.0.10 (custom)

Problem Types

Type	CWE ID	Description
text	N/A	Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle VM VirtualBox.

Type: text

CWE ID: N/A

Description: Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle VM VirtualBox.

References

Hyperlink	Resource
http://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html	x_refsource_MISC
http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00056.html	vendor-advisory x_refsource_SUSE
https://security.gentoo.org/glsa/202101-09	vendor-advisory x_refsource_GENTOO

Hyperlink: http://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html

Resource:

x_refsource_MISC

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00056.html

Resource:

vendor-advisory

x_refsource_SUSE

Hyperlink: https://security.gentoo.org/glsa/202101-09

Resource:

vendor-advisory

x_refsource_GENTOO

▼Authorized Data Publishers (ADP)

1. CVE Program Container

References

Hyperlink	Resource
http://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html	x_refsource_MISC x_transferred
http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00056.html	vendor-advisory x_refsource_SUSE x_transferred
https://security.gentoo.org/glsa/202101-09	vendor-advisory x_refsource_GENTOO x_transferred

Hyperlink: http://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html

Resource:

x_refsource_MISC

x_transferred

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00056.html

Resource:

vendor-advisory

x_refsource_SUSE

x_transferred

Hyperlink: https://security.gentoo.org/glsa/202101-09

Resource:

vendor-advisory

x_refsource_GENTOO

x_transferred

2. CISA ADP Vulnrichment

Metrics Other Info

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:secalert_us@oracle.com

Published At:23 Jul, 2019 | 23:15

Updated At:16 Feb, 2021 | 23:45

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	3.3	LOW	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Primary	2.0	2.1	LOW	AV:L/AC:L/Au:N/C:N/I:N/A:P

Type: Primary

Version: 3.1

Base score: 3.3

Base severity: LOW

Vector:

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Type: Primary

Version: 2.0

Base score: 2.1

Base severity: LOW

Vector:

AV:L/AC:L/Au:N/C:N/I:N/A:P

CPE Matches

Oracle Corporation

>>vm_virtualbox>>Versions before 5.2.32(exclusive)

cpe:2.3:a:oracle:vm_virtualbox:*:*:*:*:*:*:*:*

Oracle Corporation

>>vm_virtualbox>>Versions from 6.0.0(inclusive) to 6.0.10(exclusive)

cpe:2.3:a:oracle:vm_virtualbox:*:*:*:*:*:*:*:*

openSUSE

>>leap>>15.0

cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*

openSUSE

>>leap>>15.1

cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
NVD-CWE-noinfo	Primary	nvd@nist.gov

CWE ID: NVD-CWE-noinfo

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00056.html	secalert_us@oracle.com	Mailing List Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html	secalert_us@oracle.com	Patch Vendor Advisory
https://security.gentoo.org/glsa/202101-09	secalert_us@oracle.com	Third Party Advisory

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00056.html

Source: secalert_us@oracle.com

Resource:

Mailing List

Third Party Advisory

Hyperlink: http://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html

Source: secalert_us@oracle.com

Resource:

Patch

Vendor Advisory

Hyperlink: https://security.gentoo.org/glsa/202101-09

Source: secalert_us@oracle.com

Resource:

Third Party Advisory

Similar CVEs

157Records found

CVE-2014-8136

Matching Score-8

Assigner-Red Hat, Inc.

View Details

Matching Score-8

Assigner-Red Hat, Inc.

CVSS Score-2.1||LOW

EPSS-0.13% / 33.47%

7 Day CHG~0.00%

Published-19 Dec, 2014 | 15:00

Updated-12 Apr, 2025 | 10:46

The (1) qemuDomainMigratePerform and (2) qemuDomainMigrateFinish2 functions in qemu/qemu_driver.c in libvirt do not unlock the domain when an ACL check fails, which allow local users to cause a denial of service via unspecified vectors.

Vendor-mageia n/a Red Hat, Inc.openSUSE Canonical Ltd.

Product-enterprise_linux_server enterprise_linux_hpc_node opensuse ubuntu_linux enterprise_linux_desktop mageia libvirt enterprise_linux_workstation n/a

CVE-2024-21151

Matching Score-8

Assigner-Oracle

View Details

Matching Score-8

Assigner-Oracle

CVSS Score-3.3||LOW

EPSS-0.02% / 4.50%

7 Day CHG-0.02%

Published-16 Jul, 2024 | 22:40

Updated-05 Dec, 2024 | 21:41

Vulnerability in the Oracle Solaris product of Oracle Systems (component: Filesystem). The supported version that is affected is 11. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Solaris. CVSS 3.1 Base Score 3.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).

Vendor-Oracle Corporation

Product-solaris Solaris Operating System

CVE-2021-20227

Matching Score-8

Assigner-Red Hat, Inc.

View Details

Matching Score-8

Assigner-Red Hat, Inc.

CVSS Score-5.5||MEDIUM

EPSS-0.21% / 43.96%

7 Day CHG~0.00%

Published-23 Mar, 2021 | 00:00

Updated-03 Aug, 2024 | 17:30

A flaw was found in SQLite's SELECT query functionality (src/select.c). This flaw allows an attacker who is capable of running SQL queries locally on the SQLite database to cause a denial of service or possible code execution by triggering a use-after-free. The highest threat from this vulnerability is to system availability.

Vendor-sqlite n/a Oracle Corporation

Product-enterprise_manager_for_oracle_database sqlite communications_network_charging_and_control zfs_storage_appliance_kit outside_in_technology jd_edwards_enterpriseone_tools mysql_workbench sqlite

CWE ID-CWE-416

Use After Free

CVE-2016-9960

Matching Score-8

Assigner-Debian GNU/Linux

View Details

Matching Score-8

Assigner-Debian GNU/Linux

CVSS Score-5.5||MEDIUM

EPSS-0.10% / 28.69%

7 Day CHG~0.00%

Published-06 Jun, 2017 | 18:00

Updated-20 Apr, 2025 | 01:37

game-music-emu before 0.6.1 allows local users to cause a denial of service (divide by zero and process crash).

Vendor-game-music-emu_project n/a openSUSE Novell Fedora Project

Product-fedora suse_linux_enterprise_server leap suse_linux_enterprise_software_development_kit game-music-emu suse_linux_enterprise_desktop n/a

CWE ID-CWE-369

Divide By Zero

CVE-2016-8909

Matching Score-8

Assigner-Red Hat, Inc.

View Details

Matching Score-8

Assigner-Red Hat, Inc.

CVSS Score-6||MEDIUM

EPSS-0.04% / 10.23%

7 Day CHG~0.00%

Published-04 Nov, 2016 | 21:00

Updated-12 Apr, 2025 | 10:46

The intel_hda_xfer function in hw/audio/intel-hda.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and CPU consumption) via an entry with the same value for buffer length and pointer position.

Vendor-n/a openSUSE QEMU Red Hat, Inc.Debian GNU/Linux

Product-enterprise_linux qemu openstack leap debian_linux virtualization n/a

CWE ID-CWE-835

Loop with Unreachable Exit Condition ('Infinite Loop')

CVE-2016-8910

Matching Score-8

Assigner-Red Hat, Inc.

View Details

Matching Score-8

Assigner-Red Hat, Inc.

CVSS Score-6||MEDIUM

EPSS-0.10% / 27.98%

7 Day CHG~0.00%

Published-04 Nov, 2016 | 21:00

Updated-12 Apr, 2025 | 10:46

The rtl8139_cplus_transmit function in hw/net/rtl8139.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and CPU consumption) by leveraging failure to limit the ring descriptor count.

Vendor-n/a openSUSE QEMU Red Hat, Inc.Debian GNU/Linux

Product-enterprise_linux qemu openstack leap debian_linux virtualization n/a

CWE ID-CWE-835

Loop with Unreachable Exit Condition ('Infinite Loop')

CVE-2016-9104

Matching Score-8

Assigner-Red Hat, Inc.

View Details

Matching Score-8

Assigner-Red Hat, Inc.

CVSS Score-4.4||MEDIUM

EPSS-0.12% / 31.80%

7 Day CHG~0.00%

Published-09 Dec, 2016 | 22:00

Updated-12 Apr, 2025 | 10:46

Multiple integer overflows in the (1) v9fs_xattr_read and (2) v9fs_xattr_write functions in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allow local guest OS administrators to cause a denial of service (QEMU process crash) via a crafted offset, which triggers an out-of-bounds access.

Vendor-n/a QEMU Debian GNU/Linux openSUSE

Product-debian_linux leap qemu n/a

CWE ID-CWE-190

Integer Overflow or Wraparound

CVE-2019-2875

Credits

Vendors

Products

Metrics (CVSS)

Weaknesses

Attack Patterns

Solution/Workaround

References

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

Stakeholder-Specific Vulnerability Categorization (SSVC)

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History

Similar CVEs