CVE-2020-14311 affecting package grub2 for versions less than 2.06~rc1-7

CVE-2020-14311 affecting package grub2 for versions less than 2.06rc1-7. A patched version of the package is available...

CVE-2020-14309 affecting package grub2 for versions less than 2.06~rc1-7

CVE-2020-14309 affecting package grub2 for versions less than 2.06rc1-7. A patched version of the package is available...

PT-2022-12908 · Grub2 · Grub2

Name of the Vulnerable Software and Affected Versions: grub2 versions prior to 2.06-150400.7.1 grub2 versions prior to 2.06-18.1 Description: A local attacker can exploit an Insecure Temporary File vulnerability in grub-once of grub2 to truncate arbitrary files. Recommendations: For SUSE Linux...

Mageia: Security Advisory (MGASA-2021-0315)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2020-27749 affecting package grub2 2.06~rc1-10

CVE-2020-27749 affecting package grub2 2.06rc1-10. A patched version of the package is available...

CVE-2020-14309 affecting package grub2 2.06~rc1-10

CVE-2020-14309 affecting package grub2 2.06rc1-10. A patched version of the package is available...

If certificates that signed grub are installed into db grub can be booted directly. It will then boot any kernel without signature validation. The booted kernel will think it was booted in secureboot mode and will implement lockdown yet it could have been tampered. This flaw is a reintroduction of CVE-2020-15705 and only affects grub2 versions prior to 2.06 and upstream and distributions using the shim_lock mechanism.

...

A flaw was found in grub2 in versions prior to 2.06. Setparam_prefix() in the menu rendering code performs a length calculation on the assumption that expressing a quoted single quote will require 3 characters while it actually requires 4 characters which allows an attacker to corrupt memory by one byte for each quote in the input. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

...

AZL-6466 CVE-2021-20233 affecting package grub2 for versions less than 2.06~rc1-7

A flaw was found in grub2 in versions prior to 2.06. Setparamprefix in the menu rendering code performs a length calculation on the assumption that expressing a quoted single quote will require 3 characters, while it actually requires 4 characters which allows an attacker to corrupt memory by one...

Design/Logic Flaw

A flaw was found in grub2 in versions prior to 2.06. The cutmem command does not honor secure boot locking allowing an privileged attacker to remove address ranges from memory creating an opportunity to circumvent SecureBoot protections after proper triage about grub's memory layout. The highest...

grub2 安全漏洞

grub2 is a Linux system boot program from the GNU community. A security vulnerability in versions of grub2 prior to 2.06, where the cutmem command does not support secure boot locking, allows a privileged attacker to remove address ranges from memory, thus giving the opportunity to bypass secure...

CVE-2020-27779

A flaw was found in grub2 in versions prior to 2.06. The cutmem command does not honor secure boot locking allowing an privileged attacker to remove address ranges from memory creating an opportunity to circumvent SecureBoot protections after proper triage about grub's memory layout. The highest...

PT-2021-5815

Name of the Vulnerable Software and Affected Versions grub2 versions prior to 2.06 Description A flaw was found in the menu rendering code of grub2, specifically in the Setparam prefix function, which performs a length calculation on the assumption that expressing a quoted single quote will requi...

PT-2021-5817

Name of the Vulnerable Software and Affected Versions grub2 versions prior to 2.06 Description A flaw was found in the option parser of grub2, allowing an attacker to write past the end of a heap-allocated buffer by calling certain commands with a large number of specific short forms of options...

Grub2 Input Validation Error Vulnerability

grub2 is a Linux system bootloader from the GNU Project. An input validation error vulnerability exists in grub2 versions prior to 2.06. The vulnerability originates from a networked system or product that does not properly validate incoming data. No details of the vulnerability are provided at...

grub2 heap buffer overflow vulnerability (CNVD-2020-45111)

GRUB2 is a bootloader. A heap buffer overflow vulnerability exists in the readsectionasstring function in grub2 versions prior to 2.06. An attacker can exploit this vulnerability to cause an arithmetic overflow and zero-size allocation via a malicious font file with the name UINT32MAX, which can...

CVE-2013-4441

The Phonemes mode in Pwgen 2.06 generates predictable passwords, which makes it easier for context-dependent attackers to guess the password via a brute-force attack...

DEBIAN-CVE-2013-4441

The Phonemes mode in Pwgen 2.06 generates predictable passwords, which makes it easier for context-dependent attackers to guess the password via a brute-force attack...

Default credentials

The Phonemes mode in Pwgen 2.06 generates predictable passwords, which makes it easier for context-dependent attackers to guess the password via a brute-force attack...

CVE-2013-4441

Pwgen 2.06’s Phonemes mode produces predictable passwords, enabling context-dependent attackers to brute-force-guess passwords. Affected: Pwgen 2.06; root cause: predictability in Phonemes mode. Remediation/patch details are not provided in the connected documents.