{"kind": "product", "path": "vulns/ubuntu-16.04-lts/grub2", "name": "grub2", "product": "grub2", "ecosystem": "Ubuntu:16.04:LTS", "items": [{"id": "USN-4432-2", "noindex": true, "published": "2020-08-04T23:54:15Z", "modified": "2026-06-29T13:48:03.309806315Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/usn-4432-2", "title": "grub2, grub2-signed regression", "description": "USN-4432-1 fixed vulnerabilities in GRUB2 affecting Secure Boot\nenvironments. Unfortunately, the update introduced regressions for\nsome BIOS systems (either pre-UEFI or UEFI configured in Legacy mode),\npreventing them from successfully booting. This update addresses\nthe issue.\n\nUsers with BIOS systems that installed GRUB2 versions from USN-4432-1\nshould verify that their GRUB2 installation has a correct understanding\nof their boot device location and installed the boot loader correctly.\n\nWe apologize for the inconvenience.\n\nOriginal advisory details:\n\n Jesse Michael and Mickey Shkatov discovered that the configuration parser\n in GRUB2 did not", "references": ["https://ubuntu.com/security/notices/USN-4432-2", "https://launchpad.net/bugs/1889556", "https://osv.dev/vulnerability/USN-4432-2"], "fixes": ["2.02~beta2-36ubuntu3.27"], "products": [{"name": "grub2", "path": "vulns/ubuntu-16.04-lts/grub2", "ecosystem": "Ubuntu:16.04:LTS"}]}, {"id": "CVE-2020-14311", "noindex": false, "published": "2020-07-31T20:56:30.000Z", "modified": "2024-08-04T12:39:36.229Z", "cvss": 5.7, "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H", "severity": "medium", "epss": 0.00465, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2020-14311", "title": "CVE-2020-14311", "description": "There is an issue with grub2 before version 2.06 while handling symlink on ext filesystems. A filesystem containing a symbolic link with an inode size of UINT32_MAX causes an arithmetic overflow leading to a zero-sized memory allocation with subsequent heap-based buffer overflow.", "references": ["https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14311", "https://usn.ubuntu.com/4432-1/", "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00017.html"], "fixes": ["2.02~beta2-36ubuntu3.26"], "products": [{"name": "grub2", "path": "vulns/ubuntu-16.04-lts/grub2", "ecosystem": "Ubuntu:16.04:LTS"}]}, {"id": "CVE-2020-14310", "noindex": false, "published": "2020-07-31T20:55:55.000Z", "modified": "2024-08-04T12:39:36.404Z", "cvss": 5.7, "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H", "severity": "medium", "epss": 0.0046, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2020-14310", "title": "CVE-2020-14310", "description": "There is an issue on grub2 before version 2.06 at function read_section_as_string(). It expects a font name to be at max UINT32_MAX - 1 length in bytes but it doesn't verify it before proceed with buffer allocation to read the value from the font value. An attacker may leverage that by crafting a malicious font file which has a name with UINT32_MAX, leading to read_section_as_string() to an arithmetic overflow, zero-sized allocation and further heap-based buffer overflow.", "references": ["https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14310", "https://usn.ubuntu.com/4432-1/", "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00017.html"], "fixes": ["2.02~beta2-36ubuntu3.26"], "products": [{"name": "grub2", "path": "vulns/ubuntu-16.04-lts/grub2", "ecosystem": "Ubuntu:16.04:LTS"}]}, {"id": "CVE-2020-10713", "noindex": false, "published": "2020-07-30T12:58:30.000Z", "modified": "2024-08-04T11:14:14.235Z", "cvss": 8.2, "cvss_vector": "", "severity": "high", "epss": 0.01711, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2020-10713", "title": "CVE-2020-10713", "description": "A flaw was found in grub2, prior to version 2.06. An attacker may use the GRUB 2 flaw to hijack and tamper the GRUB verification process. This flaw also allows the bypass of Secure Boot protections. In order to load an untrusted or modified kernel, an attacker would first need to establish access to the system such as gaining physical access, obtain the ability to alter a pxe-boot network, or have remote access to a networked system with root access. With this access, an attacker could then craft a string to cause a buffer overflow by injecting a malicious payload that leads to arbitrary code execution within GRUB. The highest threat from thi", "references": ["https://www.debian.org/security/2020/dsa-4735", "http://www.openwall.com/lists/oss-security/2020/07/29/3", "https://bugzilla.redhat.com/show_bug.cgi?id=1825243"], "fixes": ["2.02~beta2-36ubuntu3.26"], "products": [{"name": "grub2", "path": "vulns/ubuntu-16.04-lts/grub2", "ecosystem": "Ubuntu:16.04:LTS"}]}, {"id": "CVE-2020-14309", "noindex": false, "published": "2020-07-30T12:49:31.000Z", "modified": "2024-08-04T12:39:36.530Z", "cvss": 6.7, "cvss_vector": "", "severity": "medium", "epss": 0.00482, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2020-14309", "title": "CVE-2020-14309", "description": "There's an issue with grub2 in all versions before 2.06 when handling squashfs filesystems containing a symbolic link with name length of UINT32 bytes in size. The name size leads to an arithmetic overflow leading to a zero-size allocation further causing a heap-based buffer overflow with attacker controlled data.", "references": ["https://bugzilla.redhat.com/show_bug.cgi?id=1852022", "https://security.netapp.com/advisory/ntap-20200731-0008/", "https://usn.ubuntu.com/4432-1/"], "fixes": ["2.02~beta2-36ubuntu3.26"], "products": [{"name": "grub2", "path": "vulns/ubuntu-16.04-lts/grub2", "ecosystem": "Ubuntu:16.04:LTS"}]}, {"id": "CVE-2020-14308", "noindex": false, "published": "2020-07-29T19:03:41.000Z", "modified": "2024-08-04T12:39:36.360Z", "cvss": 6.4, "cvss_vector": "", "severity": "medium", "epss": 0.00432, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2020-14308", "title": "CVE-2020-14308", "description": "In grub2 versions before 2.06 the grub memory allocator doesn't check for possible arithmetic overflows on the requested allocation size. This leads the function to return invalid memory allocations which can be further used to cause possible integrity, confidentiality and availability impacts during the boot process.", "references": ["https://bugzilla.redhat.com/show_bug.cgi?id=1852009", "http://www.openwall.com/lists/oss-security/2020/07/29/3", "https://security.netapp.com/advisory/ntap-20200731-0008/"], "fixes": ["2.02~beta2-36ubuntu3.26"], "products": [{"name": "grub2", "path": "vulns/ubuntu-16.04-lts/grub2", "ecosystem": "Ubuntu:16.04:LTS"}]}, {"id": "CVE-2020-15707", "noindex": false, "published": "2020-07-29T17:45:34.577Z", "modified": "2024-09-17T03:07:49.301Z", "cvss": 5.7, "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H", "severity": "medium", "epss": 0.01588, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2020-15707", "title": "GRUB2 contained integer overflows when handling the initrd command, leading to a heap-based buffer overflow.", "description": "Integer overflows were discovered in the functions grub_cmd_initrd and grub_initrd_init in the efilinux component of GRUB2, as shipped in Debian, Red Hat, and Ubuntu (the functionality is not included in GRUB2 upstream), leading to a heap-based buffer overflow. These could be triggered by an extremely large number of arguments to the initrd command on 32-bit architectures, or a crafted filesystem with very large files on any architecture. An attacker could use this to execute arbitrary code and bypass UEFI Secure Boot restrictions. This issue affects GRUB2 version 2.04 and prior versions.", "references": ["https://www.eclypsium.com/2020/07/29/theres-a-hole-in-the-boot/", "https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/GRUB2SecureBootBypass", "http://ubuntu.com/security/notices/USN-4432-1"], "fixes": ["2.02~beta2-36ubuntu3.26"], "products": [{"name": "grub2", "path": "vulns/ubuntu-16.04-lts/grub2", "ecosystem": "Ubuntu:16.04:LTS"}]}, {"id": "CVE-2020-15706", "noindex": false, "published": "2020-07-29T17:45:33.975Z", "modified": "2024-09-16T22:20:56.598Z", "cvss": 6.4, "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H", "severity": "medium", "epss": 0.00977, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2020-15706", "title": "GRUB2 contains a race condition leading to a use-after-free vulnerability which can be triggered by redefining a function whilst the same function is already executing.", "description": "GRUB2 contains a race condition in grub_script_function_create() leading to a use-after-free vulnerability which can be triggered by redefining a function whilst the same function is already executing, leading to arbitrary code execution and secure boot restriction bypass. This issue affects GRUB2 version 2.04 and prior versions.", "references": ["https://www.eclypsium.com/2020/07/29/theres-a-hole-in-the-boot/", "https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/GRUB2SecureBootBypass", "http://ubuntu.com/security/notices/USN-4432-1"], "fixes": ["2.02~beta2-36ubuntu3.26"], "products": [{"name": "grub2", "path": "vulns/ubuntu-16.04-lts/grub2", "ecosystem": "Ubuntu:16.04:LTS"}]}, {"id": "CVE-2020-15705", "noindex": false, "published": "2020-07-29T17:45:33.422Z", "modified": "2024-09-17T00:06:01.169Z", "cvss": 6.4, "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H", "severity": "medium", "epss": 0.01392, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2020-15705", "title": "GRUB2: avoid loading unsigned kernels when GRUB is booted directly under secureboot without shim", "description": "GRUB2 fails to validate kernel signature when booted directly without shim, allowing secure boot to be bypassed. This only affects systems where the kernel signing certificate has been imported directly into the secure boot database and the GRUB image is booted directly without the use of shim. This issue affects GRUB2 version 2.04 and prior versions.", "references": ["https://www.eclypsium.com/2020/07/29/theres-a-hole-in-the-boot/", "https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/GRUB2SecureBootBypass", "http://ubuntu.com/security/notices/USN-4432-1"], "fixes": ["2.02~beta2-36ubuntu3.26"], "products": [{"name": "grub2", "path": "vulns/ubuntu-16.04-lts/grub2", "ecosystem": "Ubuntu:16.04:LTS"}]}], "total": 9, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 1, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "grub2", "path": "vulns/ubuntu-16.04-lts/grub2", "ecosystem": "Ubuntu:16.04:LTS"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-06-29T13:48:03.309806315Z", "early_advisories": [], "license": "You may freely use the PatchFirst selection and our additions (priorities, early warnings, texts, summaries and aggregates) for your own purposes, including internal business use. Resale, commercial distribution and bulk mirroring of this selection or these additions require a written agreement with the operator. Whenever you use or publish the selection or our additions, credit PatchFirst (https://patchfirst.dev/vulns/) with this link to the regional feed page. Original records from open sources remain subject to their respective licenses and terms. These conditions do not restrict your rights to the original data, which you can obtain directly from those sources.", "terms_url": "https://patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "Records are selected, normalized and combined by PatchFirst; summaries and translations may be added. News is credited with a link to the original source in each entry.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Upstream licenses vary; see the source catalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Free public scores; attribution requested (FIRST EPSS, scores generated by Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}