CVE-2015-8370

Multiple integer underflows in Grub2 1.98 through 2.02 allow physically
proximate attackers to bypass authentication, obtain sensitive information,
or cause a denial of service (disk corruption) via backspace characters in
the (1) grub_username_get function in grub-core/normal/auth.c or the (2)
grub_password_get function in lib/crypto.c, which trigger an “Off-by-two”
or “Out of bounds overwrite” memory error.

Bugs

• <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=807614&gt;
• <https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-8370&gt;