Search CVE reports
61 – 70 of 71 results
Some fixes available 10 of 12
There's an issue with grub2 in all versions before 2.06 when handling squashfs filesystems containing a symbolic link with name length of UINT32 bytes in size. The name size leads to an arithmetic overflow leading to a zero-size...
3 affected packages
grub2, grub2-signed, grub2-unsigned
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| grub2 | Not affected | Not affected | Fixed | Fixed |
| grub2-signed | Not affected | Not affected | Fixed | Fixed |
| grub2-unsigned | Not affected | Not affected | Fixed | Fixed |
Some fixes available 10 of 12
In grub2 versions before 2.06 the grub memory allocator doesn't check for possible arithmetic overflows on the requested allocation size. This leads the function to return invalid memory allocations which can be further used to...
3 affected packages
grub2, grub2-signed, grub2-unsigned
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| grub2 | Not affected | Not affected | Fixed | Fixed |
| grub2-signed | Not affected | Not affected | Fixed | Fixed |
| grub2-unsigned | Not affected | Not affected | Fixed | Fixed |
Some fixes available 10 of 13
A flaw was found in grub2, prior to version 2.06. An attacker may use the GRUB 2 flaw to hijack and tamper the GRUB verification process. This flaw also allows the bypass of Secure Boot protections. In order to load an untrusted...
3 affected packages
grub2, grub2-signed, grub2-unsigned
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| grub2 | Not affected | Not affected | Fixed | Fixed |
| grub2-signed | Not affected | Not affected | Fixed | Fixed |
| grub2-unsigned | Not affected | Not affected | Fixed | Fixed |
A flaw was found in the grub2-set-bootflag utility of grub2. A local attacker could run this utility under resource pressure (for example by setting RLIMIT), causing grub2 configuration files to be truncated and leaving the system...
1 affected package
grub2
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| grub2 | — | — | — | Not affected |
The grub_ext2_read_block function in fs/ext2.c in GNU GRUB before 2013-11-12, as used in shlr/grub/fs/ext2.c in radare2 1.5.0, allows remote attackers to cause a denial of service (excessive stack use and application crash) via a...
2 affected packages
grub2, radare2
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| grub2 | Not affected | Not affected | Not affected | Not affected |
| radare2 | Not affected | Not in release | Not affected | Not affected |
Multiple integer underflows in Grub2 1.98 through 2.02 allow physically proximate attackers to bypass authentication, obtain sensitive information, or cause a denial of service (disk corruption) via backspace characters in the (1)...
1 affected package
grub2
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| grub2 | — | — | — | — |
The grub2 package before 2.02-0.29 in Red Hat Enterprise Linux (RHEL) 7, when used on UEFI systems, allows local users to bypass intended Secure Boot restrictions and execute non-verified code via a crafted (1) multiboot or (2)...
1 affected package
grub2
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| grub2 | — | — | — | — |
Some fixes available 48 of 50
Integer overflow in the LZO algorithm variant in Oberhumer liblzo2 and lzo-2 before 2.07 on 32-bit platforms might allow remote attackers to execute arbitrary code via a crafted Literal Run.
5 affected packages
grub2, grub2-signed, krfb, lzo2, grub2-unsigned
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| grub2 | Fixed | Fixed | Fixed | Not affected |
| grub2-signed | Not affected | Not affected | Fixed | Not affected |
| krfb | Fixed | Fixed | Fixed | Fixed |
| lzo2 | Fixed | Fixed | Fixed | Fixed |
| grub2-unsigned | Not affected | Not affected | Fixed | Not affected |
Some fixes available 1 of 56
Yann Collet LZ4 before r119, when used on certain 32-bit platforms that allocate memory beyond 0x80000000, does not properly detect integer overflows, which allows context-dependent attackers to cause a denial of service (memory...
10 affected packages
firefox, eet, grub2, efl, gtkwave...
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| firefox | — | Not affected | Not in release | Not affected |
| eet | — | Not in release | Not in release | Not in release |
| grub2 | — | Not affected | Not affected | Not affected |
| efl | — | Not affected | Not affected | Not affected |
| gtkwave | — | Not affected | Not affected | Not affected |
| lz4 | — | Not affected | Not affected | Not affected |
| php-horde-lz4 | — | Not in release | Not in release | Not affected |
| pytables | — | Not affected | Not affected | Not affected |
| thunderbird | — | Not affected | Not in release | Not affected |
| zfsutils | — | Not in release | Not in release | Not in release |
Some fixes available 15 of 20
A certain Debian patch for GNU GRUB uses world-readable permissions for grub.cfg, which allows local users to obtain password hashes, as demonstrated by reading the password_pbkdf2 directive in the file.
1 affected package
grub2
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| grub2 | — | — | Fixed | Fixed |