CVE-2015-8370

HIGH7.4EPSS 4.7%

grub2 - security update

Published: 12/16/2015Modified: 3/9/2026

Also known as:DSA-3421-1DEBIAN-CVE-2015-8370

Description

Multiple integer underflows in Grub2 1.98 through 2.02 allow physically proximate attackers to bypass authentication, obtain sensitive information, or cause a denial of service (disk corruption) via backspace characters in the (1) grub_username_get function in grub-core/normal/auth.c or the (2) grub_password_get function in lib/crypto.c, which trigger an "Off-by-two" or "Out of bounds overwrite" memory error.

Affected packages (3)

Debian/grub2from 0, < 2.02~beta2-33
Debian/grub2from 0, < 1.98+20100804-14+squeeze2
Debian/grub2from 0, < 1.99-27+deb7u3

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	HIGH7.4	CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References (1)

ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2015-8370