Most recent entries from all

ALSA-2024:2456 — Moderate: grub2 security update

Affected: AlmaLinux:9: grub2-common, AlmaLinux:9: grub2-efi-aa64, AlmaLinux:9: grub2-efi-aa64-cdboot, AlmaLinux:9: grub2-efi-aa64-modules, AlmaLinux:9: grub2-efi-x64, AlmaLinux:9: grub2-efi-x64-cdboot, AlmaLinux:9: grub2-efi-x64-modules, AlmaLinux:9: grub2-pc, AlmaLinux:9: grub2-pc-modules, AlmaLinux:9: grub2-ppc64le and 5 more

The grub2 packages provide version 2 of the Grand Unified Boot Loader (GRUB), a highly configurable and customizable boot loader with modular architecture. The packages support a variety of kernel formats, file systems, computer architectures, and hardware devices.

Security Fix(es):

* grub2: grub2-set-bootflag can be abused by local (pseudo-)users (CVE-2024-1048) * grub2: Out-of-bounds write at fs/ntfs.c may lead to unsigned code execution (CVE-2023-4692) * grub2: out-of-bounds read at fs/ntfs.c (CVE-2023-4693)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

bdu:2023-06822

BELL-CVE-2023-4692

Affected: Alpaquita:23: grub, Alpaquita:stream: grub

certfr-2024-avi-0720 — De multiples vulnérabilités ont été découvertes dans IBM QRadar SIEM. Certaines d'entre elles permettent à un attaquant…

certfr-2024-avi-0720

EUVD-2026-339098

fkie_cve-2023-4692

An out-of-bounds write flaw was found in grub2's NTFS filesystem driver. This issue may allow an attacker to present a specially crafted NTFS filesystem image, leading to grub's heap metadata corruption. In some circumstances, the attack may also corrupt the UEFI firmware heap metadata. As a result, arbitrary code execution and secure boot protection bypass may be achieved.

GHSA-6w7h-fpm5-3ww6

gsd-2023-4692

msrc_CVE-2023-4692 — Grub2: out-of-bounds write at fs/ntfs.c may lead to unsigned code execution

msrc_CVE-2023-4692

OESA-2023-1720 — grub2 security update

Affected: openEuler:20.03-LTS-SP1: grub2, openEuler:20.03-LTS-SP3: grub2, openEuler:22.03-LTS: grub2, openEuler:22.03-LTS-SP1: grub2, openEuler:22.03-LTS-SP2: grub2

GNU GRUB is a Multiboot boot loader. It was derived from GRUB, the GRand Unified Bootloader, which was originally designed and implemented by Erich Stefan Boleyn. Security Fix(es): An out-of-bounds write flaw was found in grub2's NTFS filesystem driver. This issue may allow an attacker to present a specially crafted NTFS filesystem image, leading to grub's heap metadata corruption. In some circumstances, the attack may also corrupt the UEFI firmware heap metadata. As a result, arbitrary code execution and secure boot protection bypass may be achieved.(CVE-2023-4692) An out-of-bounds read flaw was found on grub2's NTFS filesystem driver. This issue may allow a physically present attacker to present a specially crafted NTFS file system image to read arbitrary memory locations. A successful attack allows sensitive data cached in memory or EFI variable values to be leaked, presenting a high Confidentiality risk.(CVE-2023-4693)

RHSA-2024:2456 — Red Hat Security Advisory: grub2 security update

grub2: Out-of-bounds write at fs/ntfs.c may lead to unsigned code execution grub2: out-of-bounds read at fs/ntfs.c grub2: grub2-set-bootflag can be abused by local (pseudo-)users

SUSE-SU-2023:4085-1 — Security update for grub2

Security update for grub2

UBUNTU-CVE-2023-4692

Affected: Ubuntu:Pro:14.04:LTS: grub2-signed, Ubuntu:16.04:LTS: grub2-signed, Ubuntu:16.04:LTS: grub2-unsigned, Ubuntu:18.04:LTS: grub2-signed, Ubuntu:18.04:LTS: grub2-unsigned, Ubuntu:20.04:LTS: grub2-signed, Ubuntu:20.04:LTS: grub2-unsigned, Ubuntu:22.04:LTS: grub2-signed, Ubuntu:22.04:LTS: grub2-unsigned, Ubuntu:24.04:LTS: grub2-signed and 1 more

WID-SEC-W-2023-2552 — Grub2: Mehrere Schwachstellen ermöglichen Codeausführung

Ein lokaler Angreifer kann mehrere Schwachstellen in Grub2 ausnutzen, um beliebigen Programmcode auszuführen.