Read the docs
TI-2014-00900 Aliases CVE-2014-0983GHSA-p4cx-p88v-xqv9

Multiple array index errors in programs that are automatically generated by…

Priority MEDIUM 41CWE-399Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
Code execution
Confidentiality · integrity · availability
Complete · Complete · Complete
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-399 and the CVSS impact.

Summary

Multiple array index errors in programs that are automatically generated by VBox/HostServices/SharedOpenGL/crserverlib/server_dispatch.py in Oracle VirtualBox 4.2.x through 4.2.20 and 4.3.x before 4.3.8, when using 3D Acceleration, allow local guest OS users to execute arbitrary code on the Chromium server via certain CR_MESSAGE_OPCODES messages with a crafted index, which are not properly handled by the (1) CR_VERTEXATTRIB4NUBARB_OPCODE to the crServerDispatchVertexAttrib4NubARB function, (2) CR_VERTEXATTRIB1DARB_OPCODE to the crServerDispatchVertexAttrib1dARB function, (3) CR_VERTEXATTRIB1FARB_OPCODE to the crServerDispatchVertexAttrib1fARB function, (4) CR_VERTEXATTRIB1SARB_OPCODE to the crServerDispatchVertexAttrib1sARB function, (5) CR_VERTEXATTRIB2DARB_OPCODE to the crServerDispatchVertexAttrib2dARB function, (6) CR_VERTEXATTRIB2FARB_OPCODE to the crServerDispatchVertexAttrib2fARB function, (7) CR_VERTEXATTRIB2SARB_OPCODE to the crServerDispatchVertexAttrib2sARB function, (8) CR_VERTEXATTRIB3DARB_OPCODE to the crServerDispatchVertexAttrib3dARB function, (9) CR_VERTEXATTRIB3FARB_OPCODE to the crServerDispatchVertexAttrib3fARB function, (10) CR_VERTEXATTRIB3SARB_OPCODE to the crServerDispatchVertexAttrib3sARB function, (11) CR_VERTEXATTRIB4DARB_OPCODE to the crServerDispatchVertexAttrib4dARB function, (12) CR_VERTEXATTRIB4FARB_OPCODE to the crServerDispatchVertexAttrib4fARB function, and (13) CR_VERTEXATTRIB4SARB_OPCODE to the crServerDispatchVertexAttrib4sARB function.

Why it matters now

EPSS 0.08129 94th percentileScored 2026-11-07
Public exploit Yes 3 exploit referencesTagged by the CNA and NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 15

CPEVersionsRoleVendor
cpe:2.3:a:oracle:vm_virtualbox:4.2.0:*:*:*:*:*:*:*4.2.0VulnerableOracle
cpe:2.3:a:oracle:vm_virtualbox:4.2.2:*:*:*:*:*:*:*4.2.2VulnerableOracle
cpe:2.3:a:oracle:vm_virtualbox:4.2.4:*:*:*:*:*:*:*4.2.4VulnerableOracle
cpe:2.3:a:oracle:vm_virtualbox:4.2.6:*:*:*:*:*:*:*4.2.6VulnerableOracle
cpe:2.3:a:oracle:vm_virtualbox:4.2.8:*:*:*:*:*:*:*4.2.8VulnerableOracle
cpe:2.3:a:oracle:vm_virtualbox:4.2.10:*:*:*:*:*:*:*4.2.10VulnerableOracle
cpe:2.3:a:oracle:vm_virtualbox:4.2.12:*:*:*:*:*:*:*4.2.12VulnerableOracle
cpe:2.3:a:oracle:vm_virtualbox:4.2.14:*:*:*:*:*:*:*4.2.14VulnerableOracle
cpe:2.3:a:oracle:vm_virtualbox:4.2.16:*:*:*:*:*:*:*4.2.16VulnerableOracle
cpe:2.3:a:oracle:vm_virtualbox:4.2.18:*:*:*:*:*:*:*4.2.18VulnerableOracle
  • cpe:2.3:a:oracle:vm_virtualbox:4.2.0:*:*:*:*:*:*:* Versions 4.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:vm_virtualbox:4.2.2:*:*:*:*:*:*:* Versions 4.2.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:vm_virtualbox:4.2.4:*:*:*:*:*:*:* Versions 4.2.4 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:vm_virtualbox:4.2.6:*:*:*:*:*:*:* Versions 4.2.6 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:vm_virtualbox:4.2.8:*:*:*:*:*:*:* Versions 4.2.8 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:vm_virtualbox:4.2.10:*:*:*:*:*:*:* Versions 4.2.10 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:vm_virtualbox:4.2.12:*:*:*:*:*:*:* Versions 4.2.12 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:vm_virtualbox:4.2.14:*:*:*:*:*:*:* Versions 4.2.14 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:vm_virtualbox:4.2.16:*:*:*:*:*:*:* Versions 4.2.16 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:vm_virtualbox:4.2.18:*:*:*:*:*:*:* Versions 4.2.18 Vulnerable ·Oracle
Show 5 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:oracle:vm_virtualbox:4.2.20:*:*:*:*:*:*:*4.2.20VulnerableOracle
cpe:2.3:a:oracle:vm_virtualbox:4.3.0:*:*:*:*:*:*:*4.3.0VulnerableOracle
cpe:2.3:a:oracle:vm_virtualbox:4.3.2:*:*:*:*:*:*:*4.3.2VulnerableOracle
cpe:2.3:a:oracle:vm_virtualbox:4.3.4:*:*:*:*:*:*:*4.3.4VulnerableOracle
cpe:2.3:a:oracle:vm_virtualbox:4.3.6:*:*:*:*:*:*:*4.3.6VulnerableOracle
  • cpe:2.3:a:oracle:vm_virtualbox:4.2.20:*:*:*:*:*:*:* Versions 4.2.20 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:vm_virtualbox:4.3.0:*:*:*:*:*:*:* Versions 4.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:vm_virtualbox:4.3.2:*:*:*:*:*:*:* Versions 4.3.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:vm_virtualbox:4.3.4:*:*:*:*:*:*:* Versions 4.3.4 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:vm_virtualbox:4.3.6:*:*:*:*:*:*:* Versions 4.3.6 Vulnerable ·Oracle

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2014-0983
  2. 2026-10-03 Alias added: GHSA-p4cx-p88v-xqv9

References

Exploit 3

Advisory 2

Other 2

  • TI-2019-02266 Injection in Oracle Tape Library ACSLS KEVCVSS 3.1CRITICAL 9.8
  • TI-2015-00205 Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and… CVSS 2.0HIGH 10.0
  • TI-2025-21985 Integer overflow in Oracle VM VirtualBox CVSS 3.1HIGH 8.1
  • TI-2024-13903 Improper privilege management in Oracle VM VirtualBox CVSS 3.1HIGH 7.8
  • TI-2017-03706 Observable discrepancy in Intel Microprocessors with Speculative Execution CVSS 3.1MEDIUM 5.6
  • TI-2015-06741 The KVM subsystem in the Linux kernel through 4.2.6, and Xen 4.3.x through 4.6.x, allows… CVSS 3.1CRITICAL 10.0
See all 482 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences