GNU GRUB buffer error vulnerability

GRUB2 is a multiple bootloader for the GNU Project. GNU GRUB2 suffers from a buffer overflow vulnerability that stems from an integer overflow flaw found in GRUB2's BFS file system driver. No detailed vulnerability details are provided at this time...

Advisory ROSA-SA-2025-2683

Software: grub2 2.02 OS: ROSA Virtualization 3.0 packageevrstring: grub2-2.02-148.0.3 CVE-ID: CVE-2022-2601 BDU-ID: 2022-06819 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the grubfontconstructglyph function of the Grub2 operating systems boot loader is related to an operation exceeding buffer...

CVE-2022-23005

Western Digital has identified a weakness in the UFS standard that could result in a security vulnerability. This vulnerability may exist in some systems where the Host boot ROM code implements the UFS Boot feature to boot from UFS compliant storage devices. The UFS Boot feature, as specified in...

CVE-2020-11284

Locked memory can be unlocked and modified by non secure boot loader through improper system call sequence making the memory region untrusted source of input for secure boot loader in Snapdragon Auto, Snapdragon Compute, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructur...

CVE-2024-32741

A vulnerability has been identified in SIMATIC CN 4100 All versions V3.0. The affected device contains hard coded password which is used for the privileged system user root and for the boot loader GRUB by default . An attacker who manages to crack the password hash gains root access to the device...

GNU GRUB security vulnerability

GNU GRUB is a Linux system boot program from the GNU community. A security vulnerability exists in GNU GRUB that stems from grubcryptomemcmp not using a constant time algorithm, no details of the vulnerability are provided at this time...

Grub2 Security Restriction

The vulnerability of Grub2 operating system loaders is related to the incorrect use of standard permissions. Exploiting this vulnerability can allow attackers to circumvent security restrictions and gain unauthorized access to protected information...

GRUB NTFS Buffer Overflow

The vulnerability of the GRUB loader driver for NTFS operating systems involves reading memory beyond the buffer boundaries. Exploiting this vulnerability could allow an attacker to read the contents of the RAM...

Google Pixel security vulnerabilities

Google Pixel is a smartphone from the American company Google Google. Google Pixel has a security vulnerability that stems from allowing elevation of privilege in the ABL component...

CLSA-2024-1724433427 grub2: Fix of CVE-2023-4693

CVE-2023-4693: ntfs: fix an out-of-bounds read flaw on NTFS filesystem driver...

com.tencent.devops:devops-boot-starter-plugin (1.0.0), com.tencent.devops:devops-plugin-core (1.0.0) +3 more potentially affected by CVE-2024-38807 via org.springframework.boot:spring-boot-loader (>=3.3.1, <=3.3.2)

org.springframework.boot:spring-boot-loader MAVEN version =3.3.1, =3.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-loader and may be impacted: - com.tencent.devops:devops-boot-starter-plugin 1.0.0 -...

io.americanexpress.synapse:sample-function-greeter-gcp (>=0.4.0, <=0.4.10), io.zipkin:zipkin-server (>=3.0.0, <=3.3.0) +3 more potentially affected by CVE-2024-38807 via org.springframework.boot:spring-boot-loader-classic (>=3.2.0, <=3.2.8)

org.springframework.boot:spring-boot-loader-classic MAVEN version =3.2.0, =0.4.0, =3.0.0, =3.2.0, =4.1.0, =4.1.0, =4.1.3 Source cves: CVE-2024-38807 Source advisory: OSV:GHSA-7CJ3-X93G-GJ76...

io.americanexpress.synapse:sample-function-greeter-gcp (>=0.4.0, <=0.4.10), io.zipkin:zipkin-server (>=3.0.0, <=3.3.0) +3 more potentially affected by CVE-2024-38807 via org.springframework.boot:spring-boot-loader-classic (>=3.2.0, <=3.2.8)

org.springframework.boot:spring-boot-loader-classic MAVEN version =3.2.0, =0.4.0, =3.0.0, =3.2.0, =4.1.0, =4.1.0, =4.1.3 Source cves: CVE-2024-38807 Source advisory: GHSA-7CJ3-X93G-GJ76...

GHSA-7CJ3-X93G-GJ76 Signature forgery in Spring Boot's Loader

Applications that use spring-boot-loader or spring-boot-loader-classic and contain custom code that performs signature verification of nested jar files may be vulnerable to signature forgery where content that appears to have been signed by one signer has, in fact, been signed by another...

com.tencent.devops:devops-boot-starter-plugin (1.0.0), com.tencent.devops:devops-plugin-core (1.0.0) +3 more potentially affected by CVE-2024-38807 via org.springframework.boot:spring-boot-loader (>=3.3.1, <=3.3.2)

org.springframework.boot:spring-boot-loader MAVEN version =3.3.1, =3.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-loader and may be impacted: - com.tencent.devops:devops-boot-starter-plugin 1.0.0 -...

com.alipay.sofa.koupleless:arklet-springboot-starter (>=2.1.0, <=2.1.11), com.alipay.sofa.koupleless:koupleless-base-starter (>=2.1.0, <=2.1.11) +8 more potentially affected by CVE-2024-38807 via org.springframework.boot:spring-boot-loader (>=3.2.0, <=3.2.7)

org.springframework.boot:spring-boot-loader MAVEN version =3.2.0, =2.1.0, =2.1.0, =4.2.0, =4.2.0, =3.1.0, =0.4.0, =4.3.0, =4.1.0, =4.1.0, =4.1.3 Source cves: CVE-2024-38807 Source advisory: GHSA-7CJ3-X93G-GJ76...

com.alipay.sofa:ark-sofa-boot (4.1.0), com.alipay.sofa:ark-sofa-boot-starter (4.1.0) +2 more potentially affected by CVE-2024-38807 via org.springframework.boot:spring-boot-loader (>=3.1.0, <=3.1.12)

org.springframework.boot:spring-boot-loader MAVEN version =3.1.0, =4.0.0-rc1, =3.1.0, =3.1.12 Source cves: CVE-2024-38807 Source advisory: OSV:GHSA-7CJ3-X93G-GJ76...

com.alipay.sofa:ark-sofa-boot (4.1.0), com.alipay.sofa:ark-sofa-boot-starter (4.1.0) +2 more potentially affected by CVE-2024-38807 via org.springframework.boot:spring-boot-loader (>=3.1.0, <=3.1.12)

org.springframework.boot:spring-boot-loader MAVEN version =3.1.0, =4.0.0-rc1, =3.1.0, =3.1.12 Source cves: CVE-2024-38807 Source advisory: GHSA-7CJ3-X93G-GJ76...

com.alipay.sofa.koupleless:arklet-springboot-starter (>=1.0.0, <=1.4.2), com.alipay.sofa.koupleless:koupleless-base-starter (>=1.0.0, <=1.4.2) +85 more potentially affected by CVE-2024-38807 via org.springframework.boot:spring-boot-loader (>=2.7.0, <=2.7.18)

org.springframework.boot:spring-boot-loader MAVEN version =2.7.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =0.5.1, =0.5.1, =2.2.4, =2.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.1 and more Source cves: CVE-2024-38807 Source advisory:...

com.alipay.sofa.koupleless:arklet-springboot-starter (>=2.1.0, <=2.1.11), com.alipay.sofa.koupleless:koupleless-base-starter (>=2.1.0, <=2.1.11) +8 more potentially affected by CVE-2024-38807 via org.springframework.boot:spring-boot-loader (>=3.2.0, <=3.2.7)

org.springframework.boot:spring-boot-loader MAVEN version =3.2.0, =2.1.0, =2.1.0, =4.2.0, =4.2.0, =3.1.0, =0.4.0, =4.3.0, =4.1.0, =4.1.0, =4.1.3 Source cves: CVE-2024-38807 Source advisory: OSV:GHSA-7CJ3-X93G-GJ76...