grub2
37 vulnérabilités publiées citent ce produit.
Tel que les CNA l’écrivent dans leurs fiches CVE (éditeur et produit) ; les versions sont les leurs.
| CVE | Versions vulnérables | Titre | Sévérité | Publiée | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2025-4382 | ≤ 2.12 | Grub2: grub allow access to encrypted device through cli once root device is unlocked via tpm | MEDIUM 5.9 | 0.4 % | ||
| CVE-2025-0686 | ≤ 2.12 | Grub2: romfs: integer overflow when handling symlinks may lead to heap based out-of-bounds write when reading dat | MEDIUM 6.4 | 0.3 % | ||
| CVE-2025-0685 | ≤ 2.12 | Grub2: jfs: integer overflow when handling symlinks may lead to heap based out-of-bounds write when reading data | MEDIUM 6.4 | 0.3 % | ||
| CVE-2025-0684 | ≤ 2.12 | Grub2: reiserfs: integer overflow when handling symlinks may lead to heap based out-of-bounds write when reading data | MEDIUM 6.4 | 0.3 % | ||
| CVE-2025-0678 | ≤ 2.12 | Grub2: squash4: integer overflow may lead to heap based out-of-bounds write when reading data | HIGH 7.8 | 0.3 % | ||
| CVE-2024-45782 | ≤ 2.12 | Grub2: fs/hfs: strcpy() using the volume name (fs/hfs.c:382) | HIGH 7.8 | 0.2 % | ||
| CVE-2024-45778 | ≤ 2.12 | Grub2: fs/bfs: integer overflow in the bfs parser. | MEDIUM 5.5 | 0.3 % | ||
| CVE-2024-45779 | ≤ 2.12 | Grub2: fs/bfs: integer overflow leads to heap oob read in the bfs parser | MEDIUM 6.0 | 0.3 % | ||
| CVE-2024-45780 | ≤ 2.12 | Grub2: fs/tar: integer overflow causes heap oob write | MEDIUM 6.7 | 0.3 % | ||
| CVE-2025-0689 | ≤ 2.12 | Grub2: udf: heap based buffer overflow in grub_udf_read_block() may lead to arbitrary code execution | HIGH 7.8 | 0.5 % | ||
| CVE-2025-1125 | ≤ 2.12 | Grub2: fs/hfs: integer overflow may lead to heap based out-of-bounds write | HIGH 7.8 | 0.5 % | ||
| CVE-2025-0690 | ≤ 2.12 | Grub2: read: integer overflow may lead to out-of-bounds write | MEDIUM 6.1 | 0.8 % | ||
| CVE-2025-0677 | ≤ 2.12 | Grub2: ufs: integer overflow may lead to heap based out-of-bounds write when handling symlinks | MEDIUM 6.4 | 0.3 % | ||
| CVE-2025-0624 | ≤ 2.12 | Grub2: net: out-of-bounds write in grub_net_search_config_file() | HIGH 7.6 | 1.4 % | ||
| CVE-2025-1118 | ≤ 2.12 | Grub2: commands/dump: the dump command is not in lockdown when secure boot is enabled | MEDIUM 4.4 | 0.3 % | ||
| CVE-2024-45777 | ≤ 2.12 | Grub2: grub-core/gettext: integer overflow leads to heap oob write. | MEDIUM 6.7 | 0.3 % | ||
| CVE-2025-0622 | ≤ 2.12 | Grub2: command/gpg: use-after-free due to hooks not being removed on module unload | MEDIUM 6.4 | 0.3 % | ||
| CVE-2024-45783 | ≤ 2.12 | Grub2: fs/hfs+: refcount can be decremented twice | MEDIUM 4.4 | 0.3 % | ||
| CVE-2024-45781 | ≤ 2.12 | Grub2: fs/ufs: oob write in the heap | MEDIUM 6.7 | 0.3 % | ||
| CVE-2024-45776 | ≤ 2.12 | Grub2: grub-core/gettext: integer overflow leads to heap oob write and read. | MEDIUM 6.7 | 0.3 % | ||
| CVE-2024-45775 | ≤ 2.12 | Grub2: commands/extcmd: missing check for failed allocation | MEDIUM 5.2 | 0.3 % | ||
| CVE-2024-45774 | ≤ 2.12 | Grub2: reader/jpeg: heap oob write during jpeg parsing | MEDIUM 6.7 | 0.3 % | ||
| CVE-2024-1048 | | Grub2: grub2-set-bootflag can be abused by local (pseudo-)users | LOW 3.3 | 0.3 % | ||
| CVE-2022-3775 | All up to 2.06 | When rendering certain unicode sequences, grub2's font code doesn't proper validate if the informed glyph's width and height is constrained | HIGH 7.1 | 1.0 % | ||
| CVE-2022-2601 | grub2 2.06 and lower | A buffer overflow was found in grub_font_construct_glyph(). A malicious crafted pf2 font can lead to an overflow when calculating the max_gl | HIGH 8.6 | 0.5 % | ||
| CVE-2021-3697 | grub-2.06 | A crafted JPEG image may lead the JPEG reader to underflow its data pointer, allowing user-controlled data to be written in heap. To a succe | HIGH 7.0 | 0.5 % | ||
| CVE-2021-3696 | grub-2.06 | A heap out-of-bounds write may heppen during the handling of Huffman tables in the PNG reader. This may lead to data corruption in the heap | MEDIUM 4.5 | 0.5 % | ||
| CVE-2021-3695 | grub-2.06 | A crafted 16-bit grayscale PNG image may lead to a out-of-bounds write in the heap area. An attacker may take advantage of that to cause hea | MEDIUM 4.5 | 0.5 % | ||
| CVE-2021-3981 | grub2 2.06 and previous versions | A flaw in grub2 was found where its configuration file, known as grub.cfg, is being created with the wrong permission set allowing non privi | LOW 3.3 | 0.3 % | ||
| CVE-2021-3418 | Fixed in 2.06 | If certificates that signed grub are installed into db, grub can be booted directly. It will then boot any kernel without signature validati | MEDIUM 6.4 | 0.5 % | ||
| CVE-2021-20233 | grub 2.06 | A flaw was found in grub2 in versions prior to 2.06. Setparam_prefix() in the menu rendering code performs a length calculation on the assum | HIGH 8.2 | 0.6 % | ||
| CVE-2021-20225 | grub 2.06 | A flaw was found in grub2 in versions prior to 2.06. The option parser allows an attacker to write past the end of a heap-allocated buffer b | MEDIUM 6.7 | 1.0 % | ||
| CVE-2020-25632 | grub 2.06 | A flaw was found in grub2 in versions prior to 2.06. The rmmod implementation allows the unloading of a module used as a dependency without | HIGH 8.2 | 1.2 % | ||
| CVE-2020-25647 | grub 2.06 | A flaw was found in grub2 in versions prior to 2.06. During USB device initialization, descriptors are read with very little bounds checking | HIGH 7.6 | 0.8 % | ||
| CVE-2020-14372 | grub 2.06 | A flaw was found in grub2 in versions prior to 2.06, where it incorrectly enables the usage of the ACPI command when Secure Boot is enabled. | HIGH 7.5 | 1.7 % | ||
| CVE-2020-27749 | grub 2.06 | A flaw was found in grub2 in versions prior to 2.06. Variable names present are expanded in the supplied command line into their correspondi | MEDIUM 6.7 | 0.6 % | ||
| CVE-2020-27779 | grub 2.06 | A flaw was found in grub2 in versions prior to 2.06. The cutmem command does not honor secure boot locking allowing an privileged attacker t | HIGH 7.5 | 0.4 % |