CVE-2015-4896

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2015-10-21 · updated 2026-06-17

Description

Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox before 4.0.34, 4.1.42, 4.2.34, 4.3.32, and 5.0.8, when a VM has the Remote Display feature (RDP) enabled, allows remote attackers to affect availability via unknown vectors related to Core.

Affected products

Debian Linux: 7.0, 8.0, 9.0
Oracle Corporation VM VirtualBox: from 4.0.0 before 4.0.34; from 4.1.0 before 4.1.42; from 4.2.0 before 4.2.34; from 4.3.0 before 4.3.32; from 5.0.0 before 5.0.8 — fixed in 4.0.34, 4.1.42, 4.2.34, 4.3.32, 5.0.8

How to fix

Upgrade to a fixed version: Oracle Corporation VM VirtualBox 4.0.34, 4.1.42, 4.2.34, 4.3.32. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2015-4896 or the next vulnerability affects your stack