030c30350e
- VirtualBox 7.0.6 (released January 17 2023) This is a maintenance release. The following items were fixed and/or added: [1] - VMM: Fixed guru running the FreeBSD loader on older Intel CPUs without unrestricted guest support (bug #21332) - GUI: Fixed virtual machines grouping when VM was created or modified in command line (bugs #11500, #20933) - GUI: Introduced generic changes in settings dialogs - VirtioNet: Fixed broken network after loading saved state (bug #21172) - Storage: Added support for increasing the size of the following VMDK image variants: monolithicFlat, monolithicSparse, twoGbMaxExtentSparse, twoGbMaxExtentFlat - VBoxManage: Added missing --directory switch for guestcontrol mktemp command - Mouse Integration: Guest was provided with extended host mouse state (bug #21139) - DnD: Introduced generic improvements - Guest Control: Fixed handling creation mode for temporary directories (bug #21394) - Linux Host and Guest: Added initial support for building UEK7 kernel on Oracle Linux 8 - Linux Host and Guest: Added initial support for RHEL 9.1 kernel - Linux Guest Additions: Added initial support for kernel 6.2 for vboxvideo - Audio: The "--audio" option in VBoxManage is now marked as deprecated; please use "--audio-driver" and "--audio-enabled" instead. This will allow more flexibility when changing the driver and/or controlling the audio functionality Additionally, it fixes 6 CVE's: [2] CVE-2023-21886 Oracle VM VirtualBox Core Multiple Yes 8.1 Network High None None Un- changed High High High Prior to 6.1.42, prior to 7.0.6 CVE-2023-21898 Oracle VM VirtualBox Core None No 5.5 Local Low Low None Un- changed None None High Prior to 6.1.42, prior to 7.0.6 See Note 1 CVE-2023-21899 Oracle VM VirtualBox Core None No 5.5 Local Low Low None Un- changed None None High Prior to 6.1.42, prior to 7.0.6 See Note 1 CVE-2023-21884 Oracle VM VirtualBox Core None No 4.4 Local Low High None Un- changed None None High Prior to 6.1.42, prior to 7.0.6 CVE-2023-21885 Oracle VM VirtualBox Core None No 3.8 Local Low Low None Changed Low None None Prior to 6.1.42, prior to 7.0.6 See Note 2 CVE-2023-21889 Oracle VM VirtualBox Core None No 3.8 Local Low Low None Changed Low None None Prior to 6.1.42, prior to 7.0.6 Note 1: Applies to VirtualBox VMs running Windows 7 and later. Note 2: Applies to Windows only. Links: OBS-URL: https://build.opensuse.org/request/show/1060705 OBS-URL: https://build.opensuse.org/package/show/Virtualization/virtualbox?expand=0&rev=673
41 lines
1.5 KiB
Diff
41 lines
1.5 KiB
Diff
# This patch file is to warn future maintainers of VirtualBox on openSUSE
|
|
# platforms that the distributed versions of vboxadd.sh and vboxdrv.sh
|
|
# contain security holes. If you need to use these scripts in the future,
|
|
# please consult the Security Group at openSUSE.
|
|
#
|
|
# January 31, 2019 - Larry Finger
|
|
#
|
|
Index: VirtualBox-7.0.6/src/VBox/Additions/linux/installer/vboxadd.sh
|
|
===================================================================
|
|
--- VirtualBox-7.0.6.orig/src/VBox/Additions/linux/installer/vboxadd.sh
|
|
+++ VirtualBox-7.0.6/src/VBox/Additions/linux/installer/vboxadd.sh
|
|
@@ -869,9 +869,11 @@ dmnstatus()
|
|
fi
|
|
}
|
|
|
|
-for i; do
|
|
- case "$i" in quiet) QUIET=yes;; esac
|
|
-done
|
|
+echo "This script has insecurities. It must never be used in openSUSE without consultine Security."
|
|
+exit 1
|
|
+
|
|
+case "$2" in quiet)
|
|
+ QUIET=yes;;
|
|
case "$1" in
|
|
# Does setup without clean-up first and marks all kernels currently found on the
|
|
# system so that we can see later if any were added.
|
|
Index: VirtualBox-7.0.6/src/VBox/Installer/linux/vboxdrv.sh
|
|
===================================================================
|
|
--- VirtualBox-7.0.6.orig/src/VBox/Installer/linux/vboxdrv.sh
|
|
+++ VirtualBox-7.0.6/src/VBox/Installer/linux/vboxdrv.sh
|
|
@@ -48,6 +48,9 @@ DEVICE=/dev/vboxdrv
|
|
MODPROBE=/sbin/modprobe
|
|
SCRIPTNAME=vboxdrv.sh
|
|
|
|
+echo "This script has insecurities. It must never be used in openSUSE without consultine Security."
|
|
+exit 1
|
|
+
|
|
# The below is GNU-specific. See VBox.sh for the longer Solaris/OS X version.
|
|
TARGET=`readlink -e -- "${0}"` || exit 1
|
|
SCRIPT_DIR="${TARGET%/[!/]*}"
|