RockyLinux 10 : grub2 (RLSA-2025:16154)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2025:16154 advisory. grub2: grub-core/gettext: Integer overflow leads to Heap OOB Write and Read. CVE-2024-45776 grub2: fs/ufs: OOB write in the heap CVE-2024-45781 grub2:...

RLSA-2025:6990 Moderate: grub2 security update

The grub2 packages provide version 2 of the Grand Unified Boot Loader GRUB, a highly configurable and customizable boot loader with modular architecture. The packages support a variety of kernel formats, file systems, computer architectures, and hardware devices. Security Fixes: grub2: reader/jpe...

NewStart CGSL MAIN 6.06 : grub2 Multiple Vulnerabilities (NS-SA-2025-0221)

The remote NewStart CGSL host, running version MAIN 6.06, has grub2 packages installed that are affected by multiple vulnerabilities: - Multiple integer underflows in Grub2 1.98 through 2.02 allow physically proximate attackers to bypass authentication, obtain sensitive information, or cause a...

CLSA-2025-1758891628 grub2: Fix of CVE-2014-4607

CVE-2014-4607: minilzo: Update to minilzo-2.08 to fix integer overflow...

The vulnerability of Grub2 operating system loaders, related to breaches of confidentiality boundaries, allows attackers to expose confidential information.

The vulnerability of Grub2 operating system loaders is related to the violation of trust boundaries. Exploiting this vulnerability can allow an attacker to disclose confidential information...

grub2: commands/dump: The dump command is not in lockdown when secure boot is enabled

A flaw was found in grub2. Grub's dump command is not blocked when grub is in lockdown mode, which allows the user to read any memory information, and an attacker may leverage this in order to extract signatures, salts, and other sensitive information from the memory...

grub2: UFS: Integer overflow may lead to heap based out-of-bounds write when handling symlinks

A flaw was found in grub2. When performing a symlink lookup, the grub's UFS module checks the inode's data size to allocate the internal buffer to read the file content, however, it fails to check if the symlink data size has overflown. When this occurs, grubmalloc may be called with a smaller...

Grub2: fs/tar: integer overflow causes heap oob write

...

Grub2: read: integer overflow may lead to out-of-bounds write

...

Grub2: fs/hfs+: refcount can be decremented twice

...

GRUB2 does not call the module fini functions on exit, leading to Debian/Ubuntu's peimage GRUB2 module leaving UEFI system table hooks after exit. This lead to a use-after-free condition, and could possibly lead to secure boot bypass.

...

Linux Distros Unpatched Vulnerability : CVE-2023-4693

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An out-of-bounds read flaw was found on grub2's NTFS filesystem driver. This issue may allow a physically present attacker to present a specially crafted NTFS...

Important Photon OS Security Update - PHSA-2025-4.0-0861

Updates of 'shim-signed', 'grub2' packages of Photon OS have been released...

Linux Distros Unpatched Vulnerability : CVE-2022-3775

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When rendering certain unicode sequences, grub2's font code doesn't proper validate if the informed glyph's width and height is constrained within bitmap size. ...

SUSE SLED15: grub2 / grub2-arm64-efi / grub2-i386-pc / grub2-powerpc-ieee1275 / etc (SUSE-SU-2025:02813-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:02813-1 advisory. - CVE-2024-56738: Fixed side-channel attack due to not constant-time algorithm in grubcryptomemcmp bsc1234959 Other...

EulerOS 2.0 SP13 : grub2 (EulerOS-SA-2025-1976)

According to the versions of the grub2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : grub2 allowed attackers with access to the grub shell to access files on the encrypted disks.CVE-2024-49504 Tenable has extracted the preceding...

EulerOS 2.0 SP13 : grub2 (EulerOS-SA-2025-1990)

According to the versions of the grub2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : grub2 allowed attackers with access to the grub shell to access files on the encrypted disks.CVE-2024-49504 Tenable has extracted the preceding...

SUSE-SU-2025:02772-1 Recommended update for grub2

This update for grub2 fixes the following issues: - CVE-2024-56738: Fixed side-channel attack due to not constant-time algorithm in grubcryptomemcmp bsc1234959 Other fixes: - Fix test -f and -s do not work properly over the network files served via tftp and http bsc1246157, bsc1246237 - Skip moun...

Huawei EulerOS: Security Advisory for grub2 (EulerOS-SA-2025-1954)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for grub2 (EulerOS-SA-2025-1990)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...