← Vulnerability feed

Vulnerability record · CVE-2017-3316 · published 27 January 2017

CVE-2017-3316: Oracle vm virtualbox improper input validation vulnerability

Oracle · Vm Virtualbox

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: GUI). Supported versions that are affected are VirtualBox prior to 5.0.32 and prior to 5.1.14. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS v3.0 Base Score 8.4 (Confidentiality, Integrity and Availability impacts).

8.4 CVSS 3.0 High EPSS 7.0% · top 6.1% CWE-20 · Improper input validation
8.4CVSS 3.0 base score, v2 6.0
7.0%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
10References
17 Jun 2026Last modified by NVD

Description

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: GUI). Supported versions that are affected are VirtualBox prior to 5.0.32 and prior to 5.1.14. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS v3.0 Base Score 8.4 (Confidentiality, Integrity and Availability impacts).

CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://www.oracle.com/technetwork/security-advisory/cpujan2017-2881727.html PatchVendor Advisory
http://www.securityfocus.com/bid/95579
http://www.securitytracker.com/id/1037638
https://security.gentoo.org/glsa/201702-08
https://www.exploit-db.com/exploits/41196/
http://www.oracle.com/technetwork/security-advisory/cpujan2017-2881727.html PatchVendor Advisory
http://www.securityfocus.com/bid/95579
http://www.securitytracker.com/id/1037638
https://security.gentoo.org/glsa/201702-08
https://www.exploit-db.com/exploits/41196/

Track CVE-2017-3316 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2019-2725Oracle WebLogic Server Web Services deserialization RCEOracle WebLogic Server's Web Services subcomponent contains an injection flaw (CWE-74) that allows unauthenticated remote code execution over HTTP. I…KEVEPSS 100%analysed10.0CVE-2015-8104Xen vulnerabilityThe KVM subsystem in the Linux kernel through 4.2.6, and Xen 4.3.x through 4.6.x, allows guest OS users to cause a denial of service (host OS panic o…EPSS 2.5%10.0CVE-2015-0235glibc gethostbyname heap buffer overflow (GHOST)CVE-2015-0235 is a heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2 and other 2.x versions before 2.18. It is reach…EPSS 95%analysed9.1CVE-2016-5605Oracle vm virtualbox improper access control vulnerabilityUnspecified vulnerability in the Oracle VM VirtualBox component before 5.1.4 in Oracle Virtualization allows remote attackers to affect confidentiali…EPSS 2.4%9.0CVE-2018-3294Oracle vm virtualbox vulnerabilityVulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). The supported version that is affected is Prior to…EPSS 2.3%8.8CVE-2024-21113Oracle vm virtualbox improper access control vulnerabilityVulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.1…EPSS 0.39%8.8CVE-2024-21114Oracle vm virtualbox improper access control vulnerabilityVulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.1…EPSS 0.39%8.8CVE-2024-21115Oracle vm virtualbox improper access control vulnerabilityVulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.1…EPSS 0.45%

Source: NIST National Vulnerability Database (record CVE-2017-3316), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.