openSUSE Security Update: Security update for virtualbox
______________________________________________________________________________

Announcement ID:    openSUSE-SU-2021:1114-1
Rating:             important
References:         #1188045 #1188105 #1188535 #1188536 #1188537 
                    #1188538 
Cross-References:   CVE-2021-2409 CVE-2021-2442 CVE-2021-2443
                    CVE-2021-2454
CVSS scores:
                    CVE-2021-2409 (NVD) : 8.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
                    CVE-2021-2442 (NVD) : 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H
                    CVE-2021-2443 (NVD) : 7.3 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H
                    CVE-2021-2454 (NVD) : 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected Products:
                    openSUSE Leap 15.2
______________________________________________________________________________

   An update that solves four vulnerabilities and has two
   fixes is now available.

Description:

   This update for virtualbox fixes the following issues:

   Version bump to 6.1.26 (released July 28 2021 by Oracle)

   This is a maintenance release. The following items were fixed and/or added:

   - VMSVGA: fixed VM screen artifacts after restoring from saved state (bug
     #20067)
   - Storage: Fixed audio endianness for certain CUE sheet CD/DVD images.
   - VBoxHeadless: Running VM will save its state on host shutdown
   - VBoxManage: Fix OS detection for Ubuntu 20.10 ISO with unattended install
   - Linux Additions: Fixed mouse pointer offsetting issue for VMSVGA
     graphics adapter in multi-monitor VM setup (6.1.24 regression)

   Version bump to 6.1.24 (released July 20 2021 by Oracle)

   This is a maintenance release. The following items were fixed and/or added:

   - Storage: Fixed starting a VM if a device is attached to a VirtIO SCSI
     port higher than 30 (bug #20213)
   - Storage: Improvement to DVD medium change signaling
   - Serial: Fixed a the guest missing interrupts under certain circumstances
     (6.0 regression, bug #18668)
   - Audio: Multiple fixes and enhancements
   - Network: Fixed connectivity issue with virtio-net after resuming VM with
     disconnected link
   - Network: Fixed UDP GSO fragmentation issue with missing 8 bytes of
     payload at the end of the first fragment
   - API: Fixed VM configuration for recent Windows Server versions
   - Extension Pack: Fixed issues with USB webcam pass-through on Linux
   - Host and guest driver: Fix small memory leak (bug #20280)
   - Linux host and guest: Support kernel version 5.13 (bug #20456)
   - Linux host and guest: Introduce support for SUSE SLES/SLED 15 SP3
     kernels (bug #20396)
   - Linux host: Installer will not attempt to build kernel modules if system
     already has them installed and modules versions match current version
   - Guest Additions: Fixed crash on using shared clipboard (bug #19165)
   - Linux Guest Additions: Introduce support for Ubuntu specific kernels
     (bug #20325)
   - Solaris guest: Increased default memory and disk sizes
   - EFI: Support network booting with the E1000 network controller emulation
   - EFI: Stability improvements (bug #20090)

   - This release fixes boo#1188535, VUL-0: CVE-2021-2454, boo#1188536,
     VUL-0: CVE-2021-2409, boo#1188537, VUL-0: CVE-2021-2442, and
     boo#1188538, VUL-0: CVE-2021-2443.

   - Add vboximg-mount to packaging. boo#1188045.
   - Fixed CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT problem with kernel 5.13 as
     shown in boo#1188105.
   - Disable the build of kmp vboxvideo, at least temporarily.
   - Correct WantedBy entry in vboxadd-service
   - Require which for /usr/lib/virtualbox/vboxadd-service
   - fix license packaging, small cruft cleanup (avoid owning directories
     provided by filesystem rpm)


Patch Instructions:

   To install this openSUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - openSUSE Leap 15.2:

      zypper in -t patch openSUSE-2021-1114=1



Package List:

   - openSUSE Leap 15.2 (x86_64):

      python3-virtualbox-6.1.26-lp152.2.35.1
      python3-virtualbox-debuginfo-6.1.26-lp152.2.35.1
      virtualbox-6.1.26-lp152.2.35.1
      virtualbox-debuginfo-6.1.26-lp152.2.35.1
      virtualbox-debugsource-6.1.26-lp152.2.35.1
      virtualbox-devel-6.1.26-lp152.2.35.1
      virtualbox-guest-tools-6.1.26-lp152.2.35.1
      virtualbox-guest-tools-debuginfo-6.1.26-lp152.2.35.1
      virtualbox-guest-x11-6.1.26-lp152.2.35.1
      virtualbox-guest-x11-debuginfo-6.1.26-lp152.2.35.1
      virtualbox-kmp-debugsource-6.1.26-lp152.2.35.1
      virtualbox-kmp-default-6.1.26_k5.3.18_lp152.84-lp152.2.35.1
      virtualbox-kmp-default-debuginfo-6.1.26_k5.3.18_lp152.84-lp152.2.35.1
      virtualbox-kmp-preempt-6.1.26_k5.3.18_lp152.84-lp152.2.35.1
      virtualbox-kmp-preempt-debuginfo-6.1.26_k5.3.18_lp152.84-lp152.2.35.1
      virtualbox-qt-6.1.26-lp152.2.35.1
      virtualbox-qt-debuginfo-6.1.26-lp152.2.35.1
      virtualbox-vnc-6.1.26-lp152.2.35.1
      virtualbox-websrv-6.1.26-lp152.2.35.1
      virtualbox-websrv-debuginfo-6.1.26-lp152.2.35.1

   - openSUSE Leap 15.2 (noarch):

      virtualbox-guest-desktop-icons-6.1.26-lp152.2.35.1
      virtualbox-guest-source-6.1.26-lp152.2.35.1
      virtualbox-host-source-6.1.26-lp152.2.35.1


References:

   https://www.suse.com/security/cve/CVE-2021-2409.html
   https://www.suse.com/security/cve/CVE-2021-2442.html
   https://www.suse.com/security/cve/CVE-2021-2443.html
   https://www.suse.com/security/cve/CVE-2021-2454.html
   https://bugzilla.suse.com/1188045
   https://bugzilla.suse.com/1188105
   https://bugzilla.suse.com/1188535
   https://bugzilla.suse.com/1188536
   https://bugzilla.suse.com/1188537
   https://bugzilla.suse.com/1188538