CVE search results

31 – 40 of 42 results

Detailed view

Sort by:

CVE-2020-14310

High priority

Some fixes available 10 of 12

There is an issue on grub2 before version 2.06 at function read_section_as_string(). It expects a font name to be at max UINT32_MAX - 1 length in bytes but it doesn't verify it before proceed with buffer allocation to read the...

3 affected packages

grub2, grub2-signed, grub2-unsigned

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS	16.04 LTS
grub2	Not affected	Not affected	Fixed	Fixed	Fixed
grub2-signed	Not affected	Not affected	Fixed	Fixed	Fixed
grub2-unsigned	Not affected	Not affected	Fixed	Fixed	Vulnerable

CVE-2020-14309

High priority

Some fixes available 10 of 12

There's an issue with grub2 in all versions before 2.06 when handling squashfs filesystems containing a symbolic link with name length of UINT32 bytes in size. The name size leads to an arithmetic overflow leading to a zero-size...

3 affected packages

grub2, grub2-signed, grub2-unsigned

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS	16.04 LTS
grub2	Not affected	Not affected	Fixed	Fixed	Fixed
grub2-signed	Not affected	Not affected	Fixed	Fixed	Fixed
grub2-unsigned	Not affected	Not affected	Fixed	Fixed	Vulnerable

CVE-2020-14308

High priority

Some fixes available 10 of 12

In grub2 versions before 2.06 the grub memory allocator doesn't check for possible arithmetic overflows on the requested allocation size. This leads the function to return invalid memory allocations which can be further used to...

3 affected packages

grub2, grub2-signed, grub2-unsigned

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS	16.04 LTS
grub2	Not affected	Not affected	Fixed	Fixed	Fixed
grub2-signed	Not affected	Not affected	Fixed	Fixed	Fixed
grub2-unsigned	Not affected	Not affected	Fixed	Fixed	Vulnerable

CVE-2020-10713

High priority

Some fixes available 10 of 13

A flaw was found in grub2, prior to version 2.06. An attacker may use the GRUB 2 flaw to hijack and tamper the GRUB verification process. This flaw also allows the bypass of Secure Boot protections. In order to load an untrusted...

3 affected packages

grub2, grub2-signed, grub2-unsigned

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS	16.04 LTS
grub2	Not affected	Not affected	Fixed	Fixed	Fixed
grub2-signed	Not affected	Not affected	Fixed	Fixed	Fixed
grub2-unsigned	Not affected	Not affected	Fixed	Fixed	Vulnerable

CVE-2019-14865

Medium priority

Not affected

A flaw was found in the grub2-set-bootflag utility of grub2. A local attacker could run this utility under resource pressure (for example by setting RLIMIT), causing grub2 configuration files to be truncated and leaving the system...

1 affected package

grub2

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS	16.04 LTS
grub2	—	—	—	Not affected	Not affected

CVE-2017-9763

Medium priority

Vulnerable

The grub_ext2_read_block function in fs/ext2.c in GNU GRUB before 2013-11-12, as used in shlr/grub/fs/ext2.c in radare2 1.5.0, allows remote attackers to cause a denial of service (excessive stack use and application crash) via a...

2 affected packages

grub2, radare2

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS	16.04 LTS
grub2	Not affected	Not affected	Not affected	Not affected	Not affected
radare2	Not affected	Not in release	Not affected	Not affected	Vulnerable

CVE-2015-8370

Medium priority

Fixed

Multiple integer underflows in Grub2 1.98 through 2.02 allow physically proximate attackers to bypass authentication, obtain sensitive information, or cause a denial of service (disk corruption) via backspace characters in the (1)...

1 affected package

grub2

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS	16.04 LTS
grub2	—	—	—	—	—

CVE-2015-5281

Low priority

Ignored

The grub2 package before 2.02-0.29 in Red Hat Enterprise Linux (RHEL) 7, when used on UEFI systems, allows local users to bypass intended Secure Boot restrictions and execute non-verified code via a crafted (1) multiboot or (2)...

1 affected package

grub2

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS	16.04 LTS
grub2	—	—	—	—	Not affected

CVE-2014-4607

Medium priority

Some fixes available 42 of 44

Integer overflow in the LZO algorithm variant in Oberhumer liblzo2 and lzo-2 before 2.07 on 32-bit platforms might allow remote attackers to execute arbitrary code via a crafted Literal Run.

5 affected packages

grub2, grub2-signed, grub2-unsigned, krfb, lzo2

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS	16.04 LTS
grub2	Fixed	Fixed	Fixed	Not affected	Not affected
grub2-signed	Not affected	Not affected	Fixed	Not affected	Not affected
grub2-unsigned	Not affected	Not affected	Fixed	Not affected	Not affected
krfb	Fixed	Fixed	Fixed	Fixed	Fixed
lzo2	Fixed	Fixed	Fixed	Fixed	Fixed

CVE-2014-4715

Medium priority

Some fixes available 1 of 56

Yann Collet LZ4 before r119, when used on certain 32-bit platforms that allocate memory beyond 0x80000000, does not properly detect integer overflows, which allows context-dependent attackers to cause a denial of service (memory...

10 affected packages

eet, efl, firefox, grub2, gtkwave...

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS	16.04 LTS
eet	—	Not in release	Not in release	Not in release	Not in release
efl	—	Not affected	Not affected	Not affected	Not affected
firefox	—	Not affected	Not affected	Not affected	Not affected
grub2	—	Not affected	Not affected	Not affected	Not affected
gtkwave	—	Not affected	Not affected	Not affected	Not affected
lz4	—	Not affected	Not affected	Not affected	Not affected
php-horde-lz4	—	Not in release	Not in release	Not affected	Not affected
pytables	—	Not affected	Not affected	Not affected	Not affected
thunderbird	—	Not affected	Not affected	Not affected	Not affected
zfsutils	—	Not in release	Not in release	Not in release	Not in release

Export to JSON

Results by page:

Search CVE reports