Debian Security Advisory
DSA-3421-1 grub2 -- security update
- Date Reported:
- 16 Dec 2015
- Affected Packages:
- Security database references:
- In the Debian bugtracking system: Bug 807614.
In Mitre's CVE dictionary: CVE-2015-8370.
- More information:
Hector Marco and Ismael Ripoll, from Cybersecurity UPV Research Group, found an integer underflow vulnerability in Grub2, a popular bootloader. A local attacker can bypass the Grub2 authentication by inserting a crafted input as username or password.
More information: http://hmarco.org/bugs/CVE-2015-8370-Grub2-authentication-bypass.html
For the oldstable distribution (wheezy), this problem has been fixed in version 1.99-27+deb7u3.
For the stable distribution (jessie), this problem has been fixed in version 2.02~beta2-22+deb8u1.
For the unstable distribution (sid), this problem has been fixed in version 2.02~beta2-33.
We recommend that you upgrade your grub2 packages.