GNU GRUB vulnerabilities

3 known vulnerabilities in GNU GRUB from GNU Project. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.8 High severity

  GNU GRUB: Use After Free

  CVE-2022-28736Jul 20, 2023GNU Project

  There's a use-after-free vulnerability in grub_cmd_chainloader() function; The chainloader command is used to boot up operating systems that doesn't support multiboot and do not have direct support from GRUB2. When executing chainloader more than once a use-af

• 7.0 High severity

  GNU GRUB: Out-of-bounds Write

  CVE-2022-28734Jul 20, 2023GNU ProjectEPSS 1.12%

  Out-of-bounds write when handling split HTTP headers; When handling split HTTP headers, GRUB2 HTTP code accidentally moves its internal data buffer point by one position. This can lead to a out-of-bound write further when parsing the HTTP request, writing a NU

• 8.1 High severity

  GNU GRUB: Integer Underflow (Wrap or Wraparound)

  CVE-2022-28733Jul 20, 2023GNU ProjectEPSS 1.27%

  Integer underflow in grub_net_recv_ip4_packets; A malicious crafted IP packet can lead to an integer underflow in grub_net_recv_ip4_packets() function on rsm->total_len value. Under certain circumstances the total_len value may end up wrapping around to a smal