GNU grub2
9 vulnérabilités publiées citent ce produit.
Tel que les CNA l’écrivent dans leurs fiches CVE (éditeur et produit) ; les versions sont les leurs.
| CVE | Versions vulnérables | Titre | Sévérité | Publiée | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-97876 | 2.12 – < 2.16 | Bypass of GRUB lockdown restriction in Secure Boot mode via serial command MMIO base address | MEDIUM 6.4 | 0.1 % | ||
| CVE-2025-54770 | ≤ 2.14 | Grub2: use-after-free in net_set_vlan | MEDIUM 4.9 | 0.2 % | ||
| CVE-2025-61664 | ≤ 2.14 | Grub2: missing unregister call for normal_exit command may lead to use-after-free | MEDIUM 4.9 | 0.1 % | ||
| CVE-2025-61663 | ≤ 2.14 | Grub2: missing unregister call for normal commands may lead to use-after-free | MEDIUM 4.9 | 0.1 % | ||
| CVE-2025-61662 | ≤ 2.14 | Grub2: missing unregister call for gettext command may lead to use-after-free | HIGH 7.8 | 0.2 % | ||
| CVE-2025-61661 | ≤ 2.14 | Grub2: grub2: out-of-bounds write via malicious usb device | MEDIUM 4.8 | 0.2 % | ||
| CVE-2025-54771 | ≤ 2.14 | Grub2: use-after-free in grub_file_close() | MEDIUM 4.9 | 0.2 % | ||
| CVE-2024-56738 | 2.00 – 2.12 | GNU GRUB (aka GRUB2) through 2.12 does not use a constant-time algorithm for grub_crypto_memcmp and thus allows side-channel attacks. | MEDIUM 5.3 | 0.4 % | ||
| CVE-2024-56737 | 2.00 – 2.12 | GNU GRUB (aka GRUB2) through 2.12 has a heap-based buffer overflow in fs/hfs.c via crafted sblock data in an HFS filesystem. | HIGH 8.8 | 0.7 % |