Search CVE reports
31 – 40 of 40 results
CVE-2020-14308
High prioritySome fixes available 10 of 12
In grub2 versions before 2.06 the grub memory allocator doesn't check for possible arithmetic overflows on the requested allocation size. This leads the function to return invalid memory allocations which can be further used to...
3 affected packages
grub2, grub2-signed, grub2-unsigned
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS | 16.04 LTS |
|---|---|---|---|---|---|
| grub2 | Not affected | Not affected | Fixed | Fixed | Fixed |
| grub2-signed | Not affected | Not affected | Fixed | Fixed | Fixed |
| grub2-unsigned | Not affected | Not affected | Fixed | Fixed | Vulnerable |
CVE-2020-10713
High prioritySome fixes available 10 of 13
A flaw was found in grub2, prior to version 2.06. An attacker may use the GRUB 2 flaw to hijack and tamper the GRUB verification process. This flaw also allows the bypass of Secure Boot protections. In order to load an untrusted...
3 affected packages
grub2, grub2-signed, grub2-unsigned
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS | 16.04 LTS |
|---|---|---|---|---|---|
| grub2 | Not affected | Not affected | Fixed | Fixed | Fixed |
| grub2-signed | Not affected | Not affected | Fixed | Fixed | Fixed |
| grub2-unsigned | Not affected | Not affected | Fixed | Fixed | Vulnerable |
CVE-2019-14865
Medium priorityA flaw was found in the grub2-set-bootflag utility of grub2. A local attacker could run this utility under resource pressure (for example by setting RLIMIT), causing grub2 configuration files to be truncated and leaving the system...
1 affected package
grub2
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS | 16.04 LTS |
|---|---|---|---|---|---|
| grub2 | — | — | — | Not affected | Not affected |
CVE-2017-9763
Medium priorityThe grub_ext2_read_block function in fs/ext2.c in GNU GRUB before 2013-11-12, as used in shlr/grub/fs/ext2.c in radare2 1.5.0, allows remote attackers to cause a denial of service (excessive stack use and application crash) via a...
2 affected packages
grub2, radare2
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS | 16.04 LTS |
|---|---|---|---|---|---|
| grub2 | Not affected | Not affected | Not affected | Not affected | Not affected |
| radare2 | Not affected | Not in release | Not affected | Not affected | Vulnerable |
CVE-2015-8370
Medium priorityMultiple integer underflows in Grub2 1.98 through 2.02 allow physically proximate attackers to bypass authentication, obtain sensitive information, or cause a denial of service (disk corruption) via backspace characters in the (1)...
1 affected package
grub2
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS | 16.04 LTS |
|---|---|---|---|---|---|
| grub2 | — | — | — | — | — |
CVE-2015-5281
Low priorityThe grub2 package before 2.02-0.29 in Red Hat Enterprise Linux (RHEL) 7, when used on UEFI systems, allows local users to bypass intended Secure Boot restrictions and execute non-verified code via a crafted (1) multiboot or (2)...
1 affected package
grub2
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS | 16.04 LTS |
|---|---|---|---|---|---|
| grub2 | — | — | — | — | Not affected |
CVE-2014-4607
Medium prioritySome fixes available 42 of 44
Integer overflow in the LZO algorithm variant in Oberhumer liblzo2 and lzo-2 before 2.07 on 32-bit platforms might allow remote attackers to execute arbitrary code via a crafted Literal Run.
5 affected packages
grub2, grub2-signed, grub2-unsigned, krfb, lzo2
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS | 16.04 LTS |
|---|---|---|---|---|---|
| grub2 | Fixed | Fixed | Fixed | Not affected | Not affected |
| grub2-signed | Not affected | Not affected | Fixed | Not affected | Not affected |
| grub2-unsigned | Not affected | Not affected | Fixed | Not affected | Not affected |
| krfb | Fixed | Fixed | Fixed | Fixed | Fixed |
| lzo2 | Fixed | Fixed | Fixed | Fixed | Fixed |
CVE-2014-4715
Medium prioritySome fixes available 1 of 56
Yann Collet LZ4 before r119, when used on certain 32-bit platforms that allocate memory beyond 0x80000000, does not properly detect integer overflows, which allows context-dependent attackers to cause a denial of service (memory...
10 affected packages
eet, efl, firefox, grub2, gtkwave...
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS | 16.04 LTS |
|---|---|---|---|---|---|
| eet | — | Not in release | Not in release | Not in release | Not in release |
| efl | — | Not affected | Not affected | Not affected | Not affected |
| firefox | — | Not affected | Not affected | Not affected | Not affected |
| grub2 | — | Not affected | Not affected | Not affected | Not affected |
| gtkwave | — | Not affected | Not affected | Not affected | Not affected |
| lz4 | — | Not affected | Not affected | Not affected | Not affected |
| php-horde-lz4 | — | Not in release | Not in release | Not affected | Not affected |
| pytables | — | Not affected | Not affected | Not affected | Not affected |
| thunderbird | — | Not affected | Not affected | Not affected | Not affected |
| zfsutils | — | Not in release | Not in release | Not in release | Not in release |
CVE-2013-4577
Low prioritySome fixes available 15 of 20
A certain Debian patch for GNU GRUB uses world-readable permissions for grub.cfg, which allows local users to obtain password hashes, as demonstrated by reading the password_pbkdf2 directive in the file.
1 affected package
grub2
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS | 16.04 LTS |
|---|---|---|---|---|---|
| grub2 | — | — | Fixed | Fixed | Fixed |
CVE-2009-4128
Medium priorityGNU GRand Unified Bootloader (GRUB) 2 1.97 only compares the submitted portion of a password with the actual password, which makes it easier for physically proximate attackers to conduct brute force attacks and...
1 affected package
grub2
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS | 16.04 LTS |
|---|---|---|---|---|---|
| grub2 | — | — | — | — | — |