CVE-2020-15706

GRUB2 contains a race condition in grubscriptfunctioncreate leading to a use-after-free vulnerability which can be triggered by redefining a function whilst the same function is already executing, leading to arbitrary code execution and secure boot restriction bypass. This issue affects GRUB2...

CVE-2020-15707

Integer overflows were discovered in the functions grubcmdinitrd and grubinitrdinit in the efilinux component of GRUB2, as shipped in Debian, Red Hat, and Ubuntu the functionality is not included in GRUB2 upstream, leading to a heap-based buffer overflow. These could be triggered by an extremely...

CVE-2020-14308

In grub2 versions before 2.06 the grub memory allocator doesn't check for possible arithmetic overflows on the requested allocation size. This leads the function to return invalid memory allocations which can be further used to cause possible integrity, confidentiality and availability impacts...

SUSE-SU-2020:2074-1 Security update for grub2

This update for grub2 fixes the following issues: - Fix for CVE-2020-10713 bsc1168994 - Fix for CVE-2020-14308 CVE-2020-14309, CVE-2020-14310, CVE-2020-14311 bsc1173812 - Fix for CVE-2020-15706 bsc1174463 - Fix for CVE-2020-15707 bsc1174570 - Use overflow checking primitives where the arithmetic...

[SECURITY] [DSA 4735-1] grub2 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4735-1 [email protected] https://www.debian.org/security/ Yves-Alexis Perez July 29, 2020 https://www.debian.org/security/faq -...

SUSE-SU-2020:2073-1 Security update for grub2

This update for grub2 fixes the following issues: - Fix for CVE-2020-10713 bsc1168994 - Fix for CVE-2020-14308 CVE-2020-14309, CVE-2020-14310, CVE-2020-14311 bsc1173812 - Fix for CVE-2020-15706 bsc1174463 - Fix for CVE-2020-15707 bsc1174570 - Use overflow checking primitives where the arithmetic...

DSA-4735-1 grub2 - security update

Bulletin has no description...

HPESBHF04022 rev.1 - Superdome Flex Servers with Secure Boot enabled and GRUB2 vulnerability, Local Arbitrary Code Execution

Potential Security Impact: Local: Arbitrary Code Execution SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Superdome Flex Server Version 3.25.46 May 12 2020 or earlier CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- | --- | | CVE-2020-10713 |...

HPESBHF04020 rev.2 - HPE insmod and GRUB2 vulnerability, Local Arbitrary Code Execution

Potential Security Impact: Local: Arbitrary Code Execution SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. Intelligent Provisioning Gen10 and Gen10 Plus Servers - v3.30.226, v3.46, Gen9 - Prior to 2.82, Gen8 - Prior to 1.72 HPE Service Pack for ProLiant Prior to Version 2020.03.2...

grub2 security update

2.02-81.0.3 - Fix CVE-2020-10713, CVE-2020-14308, CVE-2020-14309, CVE-2020-14310, CVE-2020-14311, CVE-2020-15705, CVE-2020-15706, CVE-2020-15707 Orabug: 31225072 - Update signing certificate for efi binaries...

grub2 security update

2.02-81.0.4 - Fix CVE-2020-10713, CVE-2020-14308, CVE-2020-14309, CVE-2020-14310, CVE-2020-14311, CVE-2020-15705, CVE-2020-15706, CVE-2020-15707 Orabug: 31225072 - Update signing certificate for efi binaries 2.02-0.81.0.2 - Enable common subpackage build for aarch64 - Disable RHEL patch...

GRUB2 bootloader is vulnerable to buffer overflow

Overview The GRUB2 boot loader is vulnerable to buffer overflow, which results in arbitrary code execution during the boot process, even when Secure Boot is enabled. Description GRUB2 is a multiboot boot loader that replaced GRUB Legacy in 2012. A boot loader is the first program that runs upon...

grub2 security update

2.02-82.0.2.el82.1 - Fix CVE-2020-10713, CVE-2020-14308, CVE-2020-14309, CVE-2020-14310, CVE-2020-14311, CVE-2020-15705, CVE-2020-15706, CVE-2020-15707 Orabug: 31225072 - Update signing certificate for efi binaries...

PT-2020-3623 · Gnu +7 · Grub2 +7

Name of the Vulnerable Software and Affected Versions: grub2 versions prior to 2.06 Description: The issue is related to a buffer overflow when handling symbolic links in ext filesystems. An arithmetic overflow occurs when a filesystem contains a symbolic link with an inode size of UINT32 MAX,...

PT-2020-3621 · Gnu +7 · Grub2 +7

Name of the Vulnerable Software and Affected Versions: Grub2 versions prior to 2.06 Description: The issue is related to an integer overflow of the UINT32 value, which can allow an attacker to access confidential data, compromise its integrity, and cause a denial of service. Specifically, the...

PT-2020-3312 · Gnu +8 · Grub2 +8

The vulnerable software is GRUB2, a widely used bootloader for Linux and other operating systems. The affected versions are prior to 2.06. The issue is caused by a buffer overflow in the GRUB2 configuration file, which can be exploited by attackers to gain arbitrary code execution during the boot...

BSA-2020-1053

Security Advisory ID : BSA-2020-1053 Component : GRUB2 Revision : 1.0: Initial Security Researchers from Eclypsium disclosed “BootHole.” 1, 2.“BootHole” vulnerability in the GRUB2 bootloader opens up Windows and Linux devices using Secure Boot to attack. All operating systems using GRUB2 with...

HPSBHF03678 rev. 2 - GRUB2 Bootloader Arbitrary Code Execution

Potential Security Impact Arbitrary Code Execution Source: HP, HP Product Security Response Team PSRT Reported By: Eclypsium, Inc. VULNERABILITY SUMMARY HP has been informed of a potential security vulnerability in GRUB2 bootloaders commonly used by Linux. This vulnerability, known as “There’s a...

Important Photon OS Security Update - PHSA-2020-0120

Updates of 'grub2', 'linux' packages of Photon OS have been released...

FreeBSD bhyve code execution vulnerability

FreeBSD is a Unix-like operating system from the FreeBSD Foundation. bhyve is a virtual machine hypervisor used in it. A security vulnerability exists in the 'grub2-bhyve' port in versions of FreeBSD bhyve 525916 prior to 2020-02-12, which stems from the port failing to properly validate the...