CVE-2014-2477

38Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendepss 7.2%

from disclosure to weapon27 days

Published on NVDJul 17

1st PoC+27d

metasploitJul 15

exploitation probability

7.2%top 6% of all CVEs

observed exploitation

nono source reports it

2 public exploit(s)

Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox before 3.2.24, 4.0.26, 4.1.34, 4.2.26, and 4.3.12 allows local users to affect integrity and availability via unknown vectors related to Core, a different vulnerability than CVE-2014-2486.

Affected products

n/a · n/a

public PoCs found — 2

cve_referencewww.exploit-db.com/exploits/34333unverified exploitdbwww.exploit-db.com/exploits/34333unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://seclists.org/fulldisclosure/2014/Dec/23 http://www.exploit-db.com/exploits/34333 http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html http://www.securityfocus.com/archive/1/534161/100/0/threaded http://www.securityfocus.com/bid/68613 http://www.vmware.com/security/advisories/VMSA-2014-0012.html