debian/grub vulnerabilities

Latest debian/grub CVEs

Newest publication first

1. CVE-2023-4949 Memory Corruption Vulnerability in Grub-Legacy's XFS Implementation

   Published 2023-11-10

   Medium·CVSS 6.7 EPSS 0.26%

   An attacker with local access to a system (either through a disk or external drive) can present a modified XFS partition to grub-legacy in such a way to exploit a memory corruption in grub’s XFS file system implementation.

2. CVE-2009-4128 GNU GRand Unified Bootloader (GRUB) 2 1.97 only compares the submitted portion of a password with the actual password, which makes it easier for physically proximate attackers to conduct brute force a...

   Published 2009-12-01

   High·CVSS 7.2 EPSS 0.57%

   GNU GRand Unified Bootloader (GRUB) 2 1.97 only compares the submitted portion of a password with the actual password, which makes it easier for physically proximate attackers to conduct brute force attacks and bypass authentication by submitting a password whose length is 1.

3. CVE-2008-3896 Grub Legacy 0.97 and earlier stores pre-boot authentication passwords in the BIOS Keyboard buffer and does not clear this buffer before and after use, which allows local users to obtain sensitive info...

   Published 2008-09-03

   Low·CVSS 2.1 EPSS 0.35%

   Grub Legacy 0.97 and earlier stores pre-boot authentication passwords in the BIOS Keyboard buffer and does not clear this buffer before and after use, which allows local users to obtain sensitive information by reading the physical memory locations associated with this buffer.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.