Alerts This Week
Warning Icon 1 727
Alerts This Week
Warning Icon 1 727

Debian 10 Buster DLA-3190-2 Critical: Grub2 Code Execution Risks

debian lts
Calendar Grey December 10, 2022
Dist Debian Esm H88
Ubuntu Security Notice USN-5090-5 addresses vulnerabilities in libc6, emphasizing severe buffer overflow and unauthorized access issues.
Zhang Boyang reported that the grub2 update released as DLA 3190-1 did not correctly apply fixes for CVE-2022-2601 and CVE-2022-3775
Topics%20covered

Topics Covered

security advisory update critical code execution debian memory overflow grub2

Summary

Several issues were found in GRUB2's font handling code, which could
result in crashes and potentially execution of arbitrary code. These
could lead to by-pass of UEFI Secure Boot on affected systems.

Further, issues were found in image loading that could potentially
lead to memory overflows.

For Debian 10 buster, these problems have been fixed in version
2.06-3~deb10u3.

We recommend that you upgrade your grub2 packages.

For the detailed security status of grub2 please refer to its security
tracker page at:
https://security-tracker.debian.org/tracker/source-package/grub2

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS


Severity
critical
Lowest
Low
Medium
High
Critical

Package: grub2
Version: 2.06-3~deb10u3
CVE ID: CVE-2022-2601 CVE-2022-3775
Debian Bug: 1024617

Topics%20covered

Topics Covered

security advisory update critical code execution debian memory overflow grub2

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here