Every CVESearch/Get API key

CVE-2015-5281

The grub2 package before 2.02-0.29 in Red Hat Enterprise Linux (RHEL) 7, when used on UEFI...

2.6 LowFix available

CVE-2015-5281 is a low vulnerability (CVSS 2.6) in Redhat Enterprise Linux, published November 24, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 27th percentile. Fixed in grub2-debuginfo 1:2.02-0.29.el7.

What does this mean?
Severity
2.6 LowCVSS 2.0, NVD
Exploit chance
0.34%EPSS, 27th percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
1:2.02-0.29.el7grub2-debuginfo +19 more

Description

The grub2 package before 2.02-0.29 in Red Hat Enterprise Linux (RHEL) 7, when used on UEFI systems, allows local users to bypass intended Secure Boot restrictions and execute non-verified code via a crafted (1) multiboot or (2) multiboot2 module in the configuration file or physically proximate attackers to bypass intended Secure Boot restrictions and execute non-verified code via the (3) boot menu.

Exploit likelihood

0.34%Down 0.7 points since Feb 4, 2022
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
grub2-debuginfo
Red Hat:enterprise_linux:7::client
before 1:2.02-0.29.el7
1:2.02-0.29.el7
grub2-efi-modules
Red Hat:enterprise_linux:7::client
before 1:2.02-0.29.el7
1:2.02-0.29.el7
grub2
Red Hat:enterprise_linux:7::client
before 1:2.02-0.29.el7
1:2.02-0.29.el7
grub2-efi
Red Hat:enterprise_linux:7::client
before 1:2.02-0.29.el7
1:2.02-0.29.el7
grub2-tools
Red Hat:enterprise_linux:7::client
before 1:2.02-0.29.el7
1:2.02-0.29.el7
grub2-debuginfo
Red Hat:enterprise_linux:7::computenode
before 1:2.02-0.29.el7
1:2.02-0.29.el7
grub2-efi-modules
Red Hat:enterprise_linux:7::computenode
before 1:2.02-0.29.el7
1:2.02-0.29.el7
grub2
Red Hat:enterprise_linux:7::computenode
before 1:2.02-0.29.el7
1:2.02-0.29.el7
grub2-efi
Red Hat:enterprise_linux:7::computenode
before 1:2.02-0.29.el7
1:2.02-0.29.el7
grub2-tools
Red Hat:enterprise_linux:7::computenode
before 1:2.02-0.29.el7
1:2.02-0.29.el7
Show 10 moreShow less
Affected packages
PackageAffectedFixed
grub2-debuginfo
Red Hat:enterprise_linux:7::server
before 1:2.02-0.29.el7
1:2.02-0.29.el7
grub2-efi-modules
Red Hat:enterprise_linux:7::server
before 1:2.02-0.29.el7
1:2.02-0.29.el7
grub2
Red Hat:enterprise_linux:7::server
before 1:2.02-0.29.el7
1:2.02-0.29.el7
grub2-efi
Red Hat:enterprise_linux:7::server
before 1:2.02-0.29.el7
1:2.02-0.29.el7
grub2-tools
Red Hat:enterprise_linux:7::server
before 1:2.02-0.29.el7
1:2.02-0.29.el7
grub2-debuginfo
Red Hat:enterprise_linux:7::workstation
before 1:2.02-0.29.el7
1:2.02-0.29.el7
grub2-efi-modules
Red Hat:enterprise_linux:7::workstation
before 1:2.02-0.29.el7
1:2.02-0.29.el7
grub2
Red Hat:enterprise_linux:7::workstation
before 1:2.02-0.29.el7
1:2.02-0.29.el7
grub2-efi
Red Hat:enterprise_linux:7::workstation
before 1:2.02-0.29.el7
1:2.02-0.29.el7
grub2-tools
Red Hat:enterprise_linux:7::workstation
before 1:2.02-0.29.el7
1:2.02-0.29.el7

What each source reports

NVD Score used2.6

The grub2 package before 2.02-0.29 in Red Hat Enterprise Linux (RHEL) 7, when used on UEFI systems, allows local users to bypass intended Secure Boot restrictions and execute non-verified code via a crafted (1) multiboot or (2) multiboot2 module in the configuration file or physically proximate attackers to bypass intended Secure Boot restrictions and execute non-verified code via the (3) boot menu.

Record
CVE-2015-5281
CVSS 2.0
2.6 LowAV:L/AC:H/Au:N/C:P/I:P/A:N
Weakness
CWE-264
Updated
2026-11-02
CVE ListNo score

The grub2 package before 2.02-0.29 in Red Hat Enterprise Linux (RHEL) 7, when used on UEFI systems, allows local users to bypass intended Secure Boot restrictions and execute non-verified code via a crafted (1) multiboot or (2) multiboot2 module in the configuration file or physically proximate attackers to bypass intended Secure Boot restrictions and execute non-verified code via the (3) boot menu.

Record
CVE-2015-5281
Updated
2026-11-02
EUVDEUVD-2015-5260No score

The grub2 package before 2.02-0.29 in Red Hat Enterprise Linux (RHEL) 7, when used on UEFI systems, allows local users to bypass intended Secure Boot restrictions and execute non-verified code via a crafted (1) multiboot or (2) multiboot2 module in the configuration file or physically proximate attackers to bypass intended Secure Boot restrictions and execute non-verified code via the (3) boot menu.

Record
EUVD-2015-5260
Updated
2026-11-03
GitHub AdvisoriesGHSA-626f-gjf6-rgjrNo score

The grub2 package before 2.02-0.29 in Red Hat Enterprise Linux (RHEL) 7, when used on UEFI...

The grub2 package before 2.02-0.29 in Red Hat Enterprise Linux (RHEL) 7, when used on UEFI systems, allows local users to bypass intended Secure Boot restrictions and execute non-verified code via a crafted (1) multiboot or (2) multiboot2 module in the configuration file or physically proximate attackers to bypass intended Secure Boot restrictions and execute non-verified code via the (3) boot menu.

Record
GHSA-626f-gjf6-rgjr
Updated
2026-11-02

History

History
RecordedChangedSources
facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 14 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open