Hi folks,
wrt all these CVEs fixed in upstream's version 6.0.8 and 5.2.30, I
wonder if it would be possible to provide a backport of Virtualbox
6.0.8 to Stretch?
Due to the issues described in the other responses you've gotten, the most practical way of using the most recent version of Virtualbox in Stretch, is to use Oracle's own Debian repo.
This works fairly well, and is smoother than their MySQL repo.
https://www.virtualbox.org/wiki/Linux_Downloads
However, this can lead to "interesting" issues when e.g. Oracle messes up host OS compatibility, so use with care, consider making full clones as backups of your VMs before every host OS update to make sure that you have the option of rolling back.
--
Jan