CVE-2025-0624 affecting package grub2 for versions less than 2.06-24

CVE-2025-0624 affecting package grub2 for versions less than 2.06-24. A patched version of the package is available...

Huawei EulerOS: Security Advisory for grub2 (EulerOS-SA-2025-1688)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

K000152032: GRUB2 vulnerability CVE-2025-0678

Security Advisory Description A flaw was found in grub2. When reading data from a squash4 filesystem, grub's squash4 fs module uses user-controlled parameters from the filesystem geometry to determine the internal buffer size, however, it improperly checks for integer overflows. A maliciously...

TencentOS Server 2: grub2 (TSSA-2022:0288)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2022:0288 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities:...

SUSE SLED15 / SLES15 Security Update : grub2 (SUSE-SU-2025:01747-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:01747-1 advisory. Security fixes: - CVE-2025-4382: exposure of data from encrypted device through CLI once the root device is successful...

Alibaba Cloud Linux 3 : 0049: grub2 (ALINUX3-SA-2025:0049)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2025:0049 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2025-0624: A flaw was found in grub2. During th...

CVE-2025-4382 Grub2: grub allow access to encrypted device through cli once root device is unlocked via tpm

A flaw was found in systems utilizing LUKS-encrypted disks with GRUB configured for TPM-based auto-decryption. When GRUB is set to automatically decrypt disks using keys stored in the TPM, it reads the decryption key into system memory. If an attacker with physical access can corrupt the underlyi...

CVE-2025-4382 Grub2: grub allow access to encrypted device through cli once root device is unlocked via tpm

A flaw was found in systems utilizing LUKS-encrypted disks with GRUB configured for TPM-based auto-decryption. When GRUB is set to automatically decrypt disks using keys stored in the TPM, it reads the decryption key into system memory. If an attacker with physical access can corrupt the underlyi...

RockyLinux 9 : grub2 (RLSA-2025:2867)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2025:2867 advisory. grub2: net: Out-of-bounds write in grubnetsearchconfigfile CVE-2025-0624 Tenable has extracted the preceding description block directly from the RockyLinux securi...

Photon OS 5.0: Grub2 PHSA-2025-5.0-0481

An update of the grub2 package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-5.0-0481. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

GNU GRUB2 Buffer Overflow Vulnerability (CNVD-2025-08319)

GRUB2 is a multiple bootloader for the GNU Project. GNU GRUB2 suffers from a buffer overflow vulnerability that stems from a failure to properly account for the length of an environment variable when copying user-controlled environment variable data to an internal buffer, resulting in an...

RHEL 8 : grub2 (RHSA-2025:2653)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:2653 advisory. The grub2 packages provide version 2 of the Grand Unified Boot Loader GRUB, a highly configurable and customizable boot loader with modular...

RHEL 8 : grub2 (RHSA-2025:2784)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:2784 advisory. The grub2 packages provide version 2 of the Grand Unified Boot Loader GRUB, a highly configurable and customizable boot loader with modular...

GNU GRUB2 Buffer Overflow Vulnerability

GNU GRUB2 is an open source bootloader used to load the operating system kernel when the computer boots. GNU GRUB2 suffers from a buffer overflow vulnerability that originates from an integer overflow when reading data from the squash4 file system. An attacker can exploit this vulnerability to...

Linux Distros Unpatched Vulnerability : CVE-2020-27779

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in grub2 in versions prior to 2.06. The cutmem command does not honor secure boot locking allowing an privileged attacker to remove address...

CVE-2025-0684

A flaw was found in grub2. When performing a symlink lookup from a reiserfs filesystem, grub's reiserfs fs module uses user-controlled parameters from the filesystem geometry to determine the internal buffer size, however, it improperly checks for integer overflows. A maliciouly crafted filesyste...

CVE-2025-0678

A flaw was found in grub2. When reading data from a squash4 filesystem, grub's squash4 fs module uses user-controlled parameters from the filesystem geometry to determine the internal buffer size, however, it improperly checks for integer overflows. A maliciously crafted filesystem may lead some ...

CVE-2025-0686 Grub2: romfs: integer overflow when handling symlinks may lead to heap based out-of-bounds write when reading dat

A flaw was found in grub2. When performing a symlink lookup from a romfs filesystem, grub's romfs filesystem module uses user-controlled parameters from the filesystem geometry to determine the internal buffer size, however, it improperly checks for integer overflows. A maliciously crafted...

CVE-2025-0686

Affects grub2 ROMFS symlink handling (CVE-2025-0686). The romfs module uses user-controlled geometry parameters to size buffers in symlink lookups and fails to guard integer overflows, allowing buffer size miscalculation. This can cause grub_malloc to allocate too small a buffer, leading to out-o...

CVE-2025-0685

CVE-2025-0685 affects grub2, specifically the JFS filesystem module. The vulnerability arises from an integer overflow in buffer size calculations when reading data from JFS, allowing grub_jfs_read_file() to write beyond an internal buffer via grub_jfs_lookup_symlink(), which could corrupt grub’s...