I'm running Ubuntu 14.0.4 LTS on Oracle VirtualBox. The host system is Windows 10 with Bitdefender Antivirus.

Should I still install security updates for the guest OS?

2 Answers 2


As you said, you're virtual machine is connecting to the internet. If you're using an outdated package with security vulnerabilities, your guest OS can get compromised. (How depends on the security vulnerability and the usage of the virtual machine.)

If an attacker has access to your virtual machine, he can try to break out of the virtual machine to get access on the host system, even if the host system is fully patched. An attacker with code execution on an system in your environment is always bad, even if it's an unimportant part of your environment.

If he is on the virtual machine, he has very likely access to your local network and can attack all systems that are accessible from your system.

Another possible way could be a shared directory of the host system which is accessible from the virtual machine.

Even if the other two things are not possible and he could try an attack like the row hammer exploit to break out to the host system.

  • Really appreciate your thorough answer.
    – kmansoor
    Sep 4, 2016 at 2:02
  • If not your host machine, you local network can be breached and other machines could be accessible, if you are running the VM in bridged mode network setting. Ideally, there has to a very good reason why you would not keep your OS patched (for example certain update breaks a legacy application or that this machine is on a non-Internet connected network or something similar).
    – yetdot
    Sep 4, 2016 at 2:03
  • As to whether or not you should "care" to patch it, depends on what are you to lose if the machine/your network indeed gets compromised.
    – yetdot
    Sep 4, 2016 at 2:04

If your guest OS is connected to the internet, then absolutely. If not, I still would.

  • It is connected to the net.
    – kmansoor
    Sep 3, 2016 at 14:04
  • 2
    Can you explain why? Anything to backup your advice?
    – schroeder
    Sep 3, 2016 at 14:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .