Red Hat Security Advisory

RHSA-2023:0049

grub2 security update

Released 2023-01-09 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux BaseOS (v. 8) grub2-1:2.02-142.el8_7.1, grub2-common-1:2.02-142.el8_7.1, grub2-efi-aa64-1:2.02-142.el8_7.1 +16

Fixes 2 records

TI-2022-02403 CVE-2022-2601 · GHSA-c8f6-x9xm-x27g

Heap-based buffer overflow in grub2

MEDIUM 40

A buffer overflow was found in grub_font_construct_glyph().

CVSS 3.1HIGH 8.6 Local No auth User interaction EPSS 0.00515 Published 2022-12-14 Fixed CWE-122

TI-2022-03464 CVE-2022-3775 · GHSA-8h84-vmjf-pcmj

Out-of-bounds write in grub2

LOW 35

When rendering certain unicode sequences, grub2's font code doesn't proper validate if the informed glyph's width and height is constrained within bitmap size.

CVSS 3.1HIGH 7.1 Local Low privileges No interaction EPSS 0.01044 Published 2022-12-19 Partial fix CWE-787