Overview

File _patchinfo of Package patchinfo.37155

<patchinfo incident="37155">
  <issue tracker="cve" id="2024-45779"/>
  <issue tracker="cve" id="2024-45775"/>
  <issue tracker="cve" id="2024-45780"/>
  <issue tracker="cve" id="2024-45776"/>
  <issue tracker="cve" id="2024-45783"/>
  <issue tracker="cve" id="2024-45781"/>
  <issue tracker="cve" id="2024-45774"/>
  <issue tracker="cve" id="2024-45778"/>
  <issue tracker="cve" id="2024-45777"/>
  <issue tracker="cve" id="2024-49504"/>
  <issue tracker="cve" id="2024-56737"/>
  <issue tracker="cve" id="2024-45782"/>
  <issue tracker="cve" id="2025-0624"/>
  <issue tracker="cve" id="2025-0622"/>
  <issue tracker="cve" id="2025-0690"/>
  <issue tracker="cve" id="2025-1118"/>
  <issue tracker="cve" id="2025-0677"/>
  <issue tracker="cve" id="2025-0684"/>
  <issue tracker="cve" id="2025-0685"/>
  <issue tracker="cve" id="2025-0686"/>
  <issue tracker="cve" id="2025-0689"/>
  <issue tracker="cve" id="2025-1125"/>
  <issue tracker="cve" id="2025-0678"/>
  <issue tracker="bnc" id="1233612">VUL-0: EMBARGOED: CVE-2024-45776: grub2: overflow in .MO file (gettext) handling</issue>
  <issue tracker="bnc" id="1233616">VUL-0: EMBARGOED: CVE-2024-45783: grub2: hfsplus: refcount overflow</issue>
  <issue tracker="bnc" id="1233614">VUL-0: EMBARGOED: CVE-2024-45780: grub2: overflow in tar/cpio</issue>
  <issue tracker="bnc" id="1233608">VUL-0: EMBARGOED: CVE-2024-45779: grub2: bfs: heap overflow</issue>
  <issue tracker="bnc" id="1233609">VUL-0: EMBARGOED: CVE-2024-45774: grub2: heap overflows in JPEG parser</issue>
  <issue tracker="bnc" id="1229164">VUL-0: CVE-2024-49504: grub2: Bypassing TPM-bound disk encryption on SL(E)M encrypted Images</issue>
  <issue tracker="bnc" id="1233615">VUL-0: EMBARGOED: CVE-2024-45782: grub2: hfs: strcpy overflow</issue>
  <issue tracker="bnc" id="1233610">VUL-0: EMBARGOED: CVE-2024-45775: grub2: missing NULL check in extcmd parser</issue>
  <issue tracker="bnc" id="1233606">VUL-0: EMBARGOED: CVE-2024-45778: grub2: bfs filesystem not fuzzing stable</issue>
  <issue tracker="bnc" id="1233617">VUL-0: EMBARGOED: CVE-2024-45781: grub2: ufs: strcpy overflow</issue>
  <issue tracker="bnc" id="1229163">AUDIT-0: grub2: review grub2 patches for TPM-bound disk encryption on SL(E)M encrypted Images</issue>
  <issue tracker="bnc" id="1233613">VUL-0: EMBARGOED: CVE-2024-45777: grub2: integer overflow in gettext</issue>
  <issue tracker="bnc" id="1234958">VUL-0: CVE-2024-56737: grub2: heap-based buffer overflow in fs/hfs.c via crafted sblock data in an HFS filesystem</issue>
  <issue tracker="bnc" id="1237006">VUL-0: EMBARGOED: CVE-2025-0678: grub2: squash4: Integer overflow may lead to heap based out-of-bounds write when reading data</issue>
  <issue tracker="bnc" id="1237014">VUL-0: EMBARGOED: CVE-2025-1125: grub2: fs/hfs: Interger overflow may lead to heap based out-of-bounds write</issue>
  <issue tracker="bnc" id="1237011">VUL-0: EMBARGOED: CVE-2025-0689: grub2: udf: Heap based buffer overflow in grub_udf_read_block() may lead to arbitrary code execution</issue>
  <issue tracker="bnc" id="1237010">VUL-0: EMBARGOED: CVE-2025-0686: grub2: romfs: Integer overflow when handling symlinks may lead to heap based out-of-bounds write when reading data</issue>
  <issue tracker="bnc" id="1237009">VUL-0: EMBARGOED: CVE-2025-0685: grub2: jfs: Integer overflow when handling symlinks may lead to heap based out-of-bounds write when reading data</issue>
  <issue tracker="bnc" id="1237008">VUL-0: EMBARGOED: CVE-2025-0684: grub2: reiserfs: Integer overflow when handling symlinks may lead to heap based out-of-bounds write when reading data</issue>
  <issue tracker="bnc" id="1237002">VUL-0: EMBARGOED: CVE-2025-0677: grub2: UFS: Integer overflow may lead to heap based out-of-bounds write when handling symlinks</issue>
  <issue tracker="bnc" id="1237013">VUL-0: EMBARGOED: CVE-2025-1118: grub2: commands/dump: The dump command is not in lockdown when secure boot is enabled</issue>
  <issue tracker="bnc" id="1237012">VUL-0: EMBARGOED: CVE-2025-0690: grub2: read: Integer overflow may lead to out-of-bounds write</issue>
  <issue tracker="bnc" id="1236317">VUL-0: EMBARGOED: CVE-2025-0622: grub2: command/gpg: Use-after-free due to hooks not being removed on module unload</issue>
  <issue tracker="bnc" id="1236316">VUL-0: EMBARGOED: CVE-2025-0624: grub2: net: Out-of-bounds write in grub_net_search_config_file()</issue>
  <packager>michael-chang</packager>
  <rating>important</rating>
  <category>security</category>
  <summary>Security update for grub2</summary>
  <description>This update for grub2 fixes the following issues:

- CVE-2024-45781: Fixed strcpy overflow in ufs. (bsc#1233617)
- CVE-2024-56737: Fixed a heap-based buffer overflow in hfs. (bsc#1234958)
- CVE-2024-45782: Fixed strcpy overflow in hfs. (bsc#1233615)
- CVE-2024-45780: Fixed an overflow in tar/cpio. (bsc#1233614)
- CVE-2024-45783: Fixed a refcount overflow in hfsplus. (bsc#1233616)
- CVE-2024-45774: Fixed a heap overflow in JPEG parser. (bsc#1233609)
- CVE-2024-45775: Fixed a missing NULL check in extcmd parser. (bsc#1233610)
- CVE-2024-45776: Fixed an overflow in .MO file handling. (bsc#1233612)
- CVE-2024-45777: Fixed an integer overflow in gettext. (bsc#1233613)
- CVE-2024-45778: Fixed bfs filesystem by removing it from lockdown capable modules. (bsc#1233606)
- CVE-2024-45779: Fixed a heap overflow in bfs. (bsc#1233608)
- CVE-2024-49504: Fixed an issue that can bypass TPM-bound disk encryption on SL(E)M encrypted Images. (bsc#1229164)
- CVE-2025-0624: Fixed an out-of-bounds write during the network boot process. (bsc#1236316)
- CVE-2025-0622: Fixed a use-after-free when handling hooks during module unload in command/gpg . (bsc#1236317)
- CVE-2025-0690: Fixed an integer overflow that may lead to an out-of-bounds write through the read command.
  (bsc#1237012)
- CVE-2025-1118: Fixed an issue where the dump command was not being blocked when grub was in lockdown mode.
  (bsc#1237013)
- CVE-2025-0677: Fixed an integer overflow that may lead to an out-of-bounds write when handling symlinks in ufs.
  (bsc#1237002)
- CVE-2025-0684: Fixed an integer overflow that may lead to an out-of-bounds write when handling symlinks in reiserfs.
  (bsc#1237008)
- CVE-2025-0685: Fixed an integer overflow that may lead to an out-of-bounds write when handling symlinks in jfs.
  (bsc#1237009)
- CVE-2025-0686: Fixed an integer overflow that may lead to an out-of-bounds write when handling symlinks in romfs.
  (bsc#1237010)
- CVE-2025-0689: Fixed a heap-based buffer overflow in udf that may lead to arbitrary code execution. (bsc#1237011)
- CVE-2025-1125: Fixed an integer overflow that may lead to an out-of-bounds write in hfs. (bsc#1237014)
- CVE-2025-0678: Fixed an integer overflow that may lead to an out-of-bounds write in squash4. (bsc#1237006)
</description>
</patchinfo>
openSUSE Build Service is sponsored by
Places