id	summary	reporter	owner	description	type	status	component	version	resolution	keywords	cc	guest	host
16391	Installation MSI files are still signed with SHA1 and not SHA256	talr		"The MSI files for vbox 4.3.40 & 5.1 (only checked these) are only signed with SHA1
where as files such as common.cab is signed also with SHA256

for example: 
VirtualBox-5.1.0-108711-Win.exe --extract
look inside %temp%\Virtualbox\

see files signature:
VirtualBox-5.1.0-r108711-MultiArch_amd64.msi
VirtualBox-5.1.0-r108711-MultiArch_x86.msi"	defect	closed	installer	VirtualBox 5.1.0	invalid			Linux	Windows