Tobias Stefan Richter has identified a vulnerability in vbox3, which can be exploited by malicious, local users to gain escalated privileges.

The problem is that the included vboxgetty program doesn't drop permissions correctly before calling a user's tcl script. This can be exploited to gain escalated privileges via a specially crafted tcl script.

The vulnerability has been reported in version 0.1.7 and prior.

Solution
Update to version 0.1.8 or later.
Further details available in Customer Area

Provided and/or discovered by
Tobias Stefan Richter

Changelog
Further details available in Customer Area

Original Advisory

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area