p PatchFirst

CVE-2015-8370

CVE-2015-8370

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Multiple integer underflows in Grub2 1.98 through 2.02 allow physically proximate attackers to bypass authentication, obtain sensitive information, or cause a denial of service (disk corruption) via backspace characters in the (1) grub_username_get function in grub-core/normal/auth.c or the (2) grub_password_get function in lib/crypto.c, which trigger an "Off-by-two" or "Out of bounds overwrite" memory error.

CVSS 7.4 · High · EPSS 1.1% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • grub2 Debian:12

    Affected ranges
    • ECOSYSTEM: < 2.02~beta2-33

    Update to 2.02~beta2-33

  • grub2 Debian:13

    Affected ranges
    • ECOSYSTEM: < 2.02~beta2-33

    Update to 2.02~beta2-33

  • grub2 Debian:14

    Affected ranges
    • ECOSYSTEM: < 2.02~beta2-33

    Update to 2.02~beta2-33

  • grub2 Ubuntu:14.04:LTS

    Versions
    • 2.00-19ubuntu2
    • 2.00-19ubuntu3
    • 2.00-19ubuntu4
    • 2.00-20
    • 2.00-21
    • 2.00-22
    • 2.02~beta2-5
    • 2.02~beta2-6
    • 2.02~beta2-7
    • 2.02~beta2-8
    • 2.02~beta2-9
    • 2.02~beta2-9ubuntu1
    • 2.02~beta2-9ubuntu1.1
    • 2.02~beta2-9ubuntu1.2
    • 2.02~beta2-9ubuntu1.3
    • 2.02~beta2-9ubuntu1.4
    • 2.02~beta2-9ubuntu1.5
    Affected ranges
    • ECOSYSTEM: < 2.02~beta2-9ubuntu1.6

    Update to 2.02~beta2-9ubuntu1.6

Original sources

Check your server →