{"id":"CVE-2024-49504","aliases":["EUVD-2024-43438","GHSA-46pf-6w9r-96r9","OESA-2025-1452","SUSE-SU-2025:0586-1","SUSE-SU-2025:20511-1","SUSE-SU-2025:20863-1","UBUNTU-CVE-2024-49504","openSUSE-SU-2024:14464-1"],"status":"published","title":"grub2 allows bypassing TPM-bound disk encryption on SL(E)M encrypted Images","description":"grub2 allowed attackers with access to the grub shell to access files on the encrypted disks.","severity":{"version":"4.0","score":7,"vector":"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00323,"percentile":0.25527,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-276"],"published":"2024-11-06T00:00:00Z","modified":"2026-10-17T12:56:40Z","fixes":[{"ecosystem":"openEuler:20.03-LTS-SP4","package":"grub2","fixed_in":["2.04-41.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"grub2","fixed_in":["2.06-52.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"grub2","fixed_in":["2.06-52.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"grub2","fixed_in":["2.12-40.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"grub2","fixed_in":["2.12-40.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"grub2","fixed_in":["2.12-28.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"grub2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.04-41.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"grub2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.06-52.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"grub2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.06-52.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"grub2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12-40.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"grub2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12-40.oe2403sp1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"grub2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12-150600.8.18.2"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP6","package":"grub2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12-150600.8.18.2"}]}],"bundled":23},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"grub2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12-150600.8.18.2"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"grub2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12~rc1-6.1"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"grub2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12-slfo.1.1_2.1"}]}],"bundled":25},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"grub2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.00-19ubuntu2","2.00-19ubuntu3","2.00-19ubuntu4","2.00-20","2.00-21","2.00-22","2.02~beta2-5","2.02~beta2-6","2.02~beta2-7","2.02~beta2-8","2.02~beta2-9","2.02~beta2-9ubuntu1","2.02~beta2-9ubuntu1.1","2.02~beta2-9ubuntu1.2","2.02~beta2-9ubuntu1.3","2.02~beta2-9ubuntu1.4","2.02~beta2-9ubuntu1.5","2.02~beta2-9ubuntu1.6","2.02~beta2-9ubuntu1.7","2.02~beta2-9ubuntu1.8","2.02~beta2-9ubuntu1.11","2.02~beta2-9ubuntu1.12","2.02~beta2-9ubuntu1.14","2.02~beta2-9ubuntu1.15","2.02~beta2-9ubuntu1.16","2.02~beta2-9ubuntu1.17","2.02~beta2-9ubuntu1.20","2.02~beta2-9ubuntu1.21"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"grub2-signed","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.22","1.23","1.24","1.25","1.26","1.27","1.30","1.31","1.32","1.33","1.34","1.34.1","1.34.2","1.34.3","1.34.4","1.34.5","1.34.6","1.34.7","1.34.8","1.34.9","1.34.13","1.34.14","1.34.16","1.34.17","1.34.18","1.34.20","1.34.22","1.34.24"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"grub2-signed","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.55","1.56","1.57","1.58","1.59","1.61","1.62","1.63","1.64","1.65","1.66","1.66.1","1.66.2","1.66.6","1.66.7","1.66.8","1.66.9","1.66.11","1.66.12","1.66.14","1.66.15","1.66.16","1.66.17","1.66.18","1.66.19","1.66.20","1.66.21","1.66.22","1.66.23","1.66.26","1.66.27","1.66.28","1.66.29","1.167~16.04.1","1.167~16.04.2","1.167~16.04.4","1.167~16.04.6"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"grub2-unsigned","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.04-1ubuntu44","2.04-1ubuntu44.1","2.04-1ubuntu44.1.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"grub2-signed","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.85","1.86","1.87","1.89","1.91","1.92","1.93","1.93.1","1.93.2","1.93.3","1.93.4","1.93.5","1.93.7","1.93.8","1.93.10","1.93.11","1.93.13","1.93.14","1.93.15","1.93.16","1.93.18","1.93.19","1.93.20","1.93.21","1.93.22","1.93.24","1.167~18.04.1","1.167~18.04.3","1.167~18.04.5","1.173.2~18.04.1","1.187.2~18.04.1","1.187.3~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"grub2-unsigned","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.04-1ubuntu44","2.04-1ubuntu44.1","2.04-1ubuntu44.1.2","2.04-1ubuntu47.4","2.06-2ubuntu14","2.06-2ubuntu14.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"grub2-signed","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.128","1.129","1.130","1.131","1.133","1.134","1.135","1.136","1.137","1.138","1.139","1.140","1.141","1.142","1.142.1","1.142.3","1.142.4","1.142.5","1.142.6","1.142.8","1.142.9","1.142.10","1.142.11","1.167","1.167.2","1.173.2~20.04.1","1.173.4","1.187.2~20.04.2","1.187.3~20.04.1","1.187.4~20.04.1","1.187.6~20.04.1","1.187.12~20.04"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"grub2-unsigned","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.04-1ubuntu44","2.04-1ubuntu44.2","2.04-1ubuntu47.4","2.04-1ubuntu47.5","2.06-2ubuntu14","2.06-2ubuntu14.1","2.06-2ubuntu14.2","2.06-2ubuntu14.4","2.06-2ubuntu14.8"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"grub2-signed","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.173","1.174","1.176","1.177","1.178","1.179","1.180","1.182~22.04.1","1.187.2","1.187.3~22.04.1","1.187.4~22.04.1","1.187.6","1.187.12"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"grub2-unsigned","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.04-1ubuntu47","2.04-1ubuntu48","2.06-2ubuntu3","2.06-2ubuntu4","2.06-2ubuntu5","2.06-2ubuntu6","2.06-2ubuntu7","2.06-2ubuntu10","2.06-2ubuntu14","2.06-2ubuntu14.1","2.06-2ubuntu14.2","2.06-2ubuntu14.4","2.06-2ubuntu14.8"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"grub2-signed","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.197","1.199","1.201","1.202","1.202.2","1.202.5"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"grub2-unsigned","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.12~rc1-10ubuntu4","2.12~rc1-12ubuntu2","2.12-1ubuntu1","2.12-1ubuntu7","2.12-1ubuntu7.1","2.12-1ubuntu7.3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"grub2-signed","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.212","1.213","1.214"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"grub2-unsigned","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.12-5ubuntu11","2.14~git20250718.0e36779-1ubuntu1","2.14~git20250718.0e36779-1ubuntu4"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"grub2-signed","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.215"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"grub2-unsigned","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.14-2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"grub2-signed","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.214","1.215"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"grub2-unsigned","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.14~git20250718.0e36779-1ubuntu4","2.14-2ubuntu1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"grub2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12-28.1"}]}]}],"products":[{"vendor":"suse","product":"opensuse tumbleweed"},{"vendor":"suse","product":"opensuse_tumbleweed"}],"references":[{"url":"https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-49504","tags":["report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-49504","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-46pf-6w9r-96r9"},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-49504","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1452","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250586-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1229163","tags":["report"]},{"url":"https://bugzilla.suse.com/1229164","tags":["report"]},{"url":"https://bugzilla.suse.com/1233606","tags":["report"]},{"url":"https://bugzilla.suse.com/1233608","tags":["report"]},{"url":"https://bugzilla.suse.com/1233609","tags":["report"]},{"url":"https://bugzilla.suse.com/1233610","tags":["report"]},{"url":"https://bugzilla.suse.com/1233612","tags":["report"]},{"url":"https://bugzilla.suse.com/1233613","tags":["report"]},{"url":"https://bugzilla.suse.com/1233614","tags":["report"]},{"url":"https://bugzilla.suse.com/1233615","tags":["report"]},{"url":"https://bugzilla.suse.com/1233616","tags":["report"]},{"url":"https://bugzilla.suse.com/1233617","tags":["report"]},{"url":"https://bugzilla.suse.com/1234958","tags":["report"]},{"url":"https://bugzilla.suse.com/1236316","tags":["report"]},{"url":"https://bugzilla.suse.com/1236317","tags":["report"]},{"url":"https://bugzilla.suse.com/1237002","tags":["report"]},{"url":"https://bugzilla.suse.com/1237006","tags":["report"]},{"url":"https://bugzilla.suse.com/1237008","tags":["report"]},{"url":"https://bugzilla.suse.com/1237009","tags":["report"]},{"url":"https://bugzilla.suse.com/1237010","tags":["report"]},{"url":"https://bugzilla.suse.com/1237011","tags":["report"]},{"url":"https://bugzilla.suse.com/1237012","tags":["report"]},{"url":"https://bugzilla.suse.com/1237013","tags":["report"]},{"url":"https://bugzilla.suse.com/1237014","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45774","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45775","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45776","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45777","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45778","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45779","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45780","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45781","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45782","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45783","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49504","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56737","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-0622","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-0624","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-0677","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-0678","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-0684","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-0685","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-0686","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-0689","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-0690","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-1118","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-1125","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520511-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1239674","tags":["report"]},{"url":"https://bugzilla.suse.com/1242971","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4382","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520863-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1230840","tags":["report"]},{"url":"https://bugzilla.suse.com/1231591","tags":["report"]},{"url":"https://bugzilla.suse.com/1232411","tags":["report"]},{"url":"https://bugzilla.suse.com/1234959","tags":["report"]},{"url":"https://bugzilla.suse.com/1247242","tags":["report"]},{"url":"https://bugzilla.suse.com/1249140","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56738","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2024-49504","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-49504","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/KXKJ6PTYKL455DZUDWZIWJPXBAVYCPH3/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-49504","title":"grub2 allows bypassing TPM-bound disk encryption on SL(E)M encrypted Images","description":"grub2 allowed attackers with access to the grub shell to access files on the encrypted disks.","status":"published","published":"2024-11-13T14:44:23.659Z","modified":"2024-11-13T18:32:06.515Z","cvss":[{"version":"4.0","score":7,"vector":"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-276"],"updated_at":"2026-11-02T14:33:55.977982Z"}],"euvd":[{"id":"EUVD-2024-43438","description":"grub2 allowed attackers with access to the grub shell to access files on the encrypted disks.","status":"published","published":"2024-11-13T14:44:23Z","modified":"2024-11-13T18:32:06Z","cvss":[{"version":"4.0","score":7,"vector":"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-03T00:05:01.264685Z"}],"ghsa":[{"id":"GHSA-46pf-6w9r-96r9","title":"grub2 allowed attackers with access to the grub shell to access files on the encrypted disks.","description":"grub2 allowed attackers with access to the grub shell to access files on the encrypted disks.","status":"published","published":"2024-11-13T15:31:37Z","modified":"2024-11-13T21:30:34Z","cvss":[{"version":"4.0","score":7,"vector":"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"cwes":["CWE-276"],"updated_at":"2026-11-02T14:58:49.226785Z"}],"nvd":[{"id":"CVE-2024-49504","description":"grub2 allowed attackers with access to the grub shell to access files on the encrypted disks.","status":"published","published":"2024-11-13T15:15:07.767Z","modified":"2026-06-17T07:59:53.157Z","cvss":[{"version":"4.0","score":7,"vector":"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"}],"cwes":["CWE-276"],"updated_at":"2026-11-02T14:10:36.931115Z"}],"osv":[{"id":"OESA-2025-1452","title":"grub2 security update","description":"GNU GRUB is a Multiboot boot loader. It was derived from GRUB, the GRand Unified Bootloader, which was originally designed and implemented by Erich Stefan Boleyn.\r\n\r\nSecurity Fix(es):\n\ngrub2 allowed attackers with access to the grub shell to access files on the encrypted disks.(CVE-2024-49504)","status":"published","published":"2025-04-25T11:08:33Z","modified":"2026-08-18T01:17:52.308212428Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"UBUNTU-CVE-2024-49504","description":"grub2 allowed attackers with access to the grub shell to access files on the encrypted disks.","status":"published","published":"2024-11-13T15:15:00Z","modified":"2026-10-17T12:56:40.139342988Z","cvss":[{"version":"4.0","score":7,"vector":"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:55:06.818511Z"},{"id":"CVE-2024-49504","description":"grub2 allowed attackers with access to the grub shell to access files on the encrypted disks.","status":"withdrawn","published":"2024-11-13T15:15:07Z","modified":"2026-03-23T05:04:23.599996534Z","updated_at":"2026-11-02T15:44:43.597758Z"},{"id":"openSUSE-SU-2024:14464-1","title":"grub2-2.12-28.1 on GA media","description":"These are all security issues fixed in the grub2-2.12-28.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-11-06T00:00:00Z","modified":"2026-02-04T02:50:31.884328Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"SUSE-SU-2025:0586-1","title":"Security update for grub2","description":"This update for grub2 fixes the following issues:\n\n- CVE-2024-45781: Fixed strcpy overflow in ufs. (bsc#1233617)\n- CVE-2024-56737: Fixed a heap-based buffer overflow in hfs. (bsc#1234958)\n- CVE-2024-45782: Fixed strcpy overflow in hfs. (bsc#1233615)\n- CVE-2024-45780: Fixed an overflow in tar/cpio. (bsc#1233614)\n- CVE-2024-45783: Fixed a refcount overflow in hfsplus. (bsc#1233616)\n- CVE-2024-45774: Fixed a heap overflow in JPEG parser. (bsc#1233609)\n- CVE-2024-45775: Fixed a missing NULL check in extcmd parser. (bsc#1233610)\n- CVE-2024-45776: Fixed an overflow in .MO file handling. (bsc#1233612)\n- CVE-2024-45777: Fixed an integer overflow in gettext. (bsc#1233613)\n- CVE-2024-45778: Fixed bfs filesystem by removing it from lockdown capable modules. (bsc#1233606)\n- CVE-2024-45779: Fixed a heap overflow in bfs. (bsc#1233608)\n- CVE-2024-49504: Fixed an issue that can bypass TPM-bound disk encryption on SL(E)M encrypted Images. (bsc#1229164)\n- CVE-2025-0624: Fixed an out-of-bounds write during the network boot process. (bsc#1236316)\n- CVE-2025-0622: Fixed a use-after-free when handling hooks during module unload in command/gpg . (bsc#1236317)\n- CVE-2025-0690: Fixed an integer overflow that may lead to an out-of-bounds write through the read command.\n  (bsc#1237012)\n- CVE-2025-1118: Fixed an issue where the dump command was not being blocked when grub was in lockdown mode.\n  (bsc#1237013)\n- CVE-2025-0677: Fixed an integer overflow that may lead to an out-of-bounds write when handling symlinks in ufs.\n  (bsc#1237002)\n- CVE-2025-0684: Fixed an integer overflow that may lead to an out-of-bounds write when handling symlinks in reiserfs.\n  (bsc#1237008)\n- CVE-2025-0685: Fixed an integer overflow that may lead to an out-of-bounds write when handling symlinks in jfs.\n  (bsc#1237009)\n- CVE-2025-0686: Fixed an integer overflow that may lead to an out-of-bounds write when handling symlinks in romfs.\n  (bsc#1237010)\n- CVE-2025-0689: Fixed a heap-based buffer overflow in udf that may lead to arbitrary code execution. (bsc#1237011)\n- CVE-2025-1125: Fixed an integer overflow that may lead to an out-of-bounds write in hfs. (bsc#1237014)\n- CVE-2025-0678: Fixed an integer overflow that may lead to an out-of-bounds write in squash4. (bsc#1237006)\n","status":"published","published":"2025-02-19T07:28:49Z","modified":"2026-02-04T03:10:23.482868Z","updated_at":"2026-11-02T15:53:58.883365Z"},{"id":"SUSE-SU-2025:20511-1","title":"Security update for grub2","description":"This update for grub2 fixes the following issues:\n\n- CVE-2025-4382: Fixed TPM auto-decryption data exposure (bsc#1242971)\n\n- Filter out the non-subvolume btrfs mount points when creating the\n  relative path (bsc#1239674)\n\n- CVE-2024-45781: Fixed ufs strcpy overflow (bsc#1233617)\n- CVE-2024-56737: Fixed heap-based buffer overflow in fs/hfs.c via\n  crafted sblock data in an HFS filesystem (bsc#1234958)\n- CVE-2024-45782: Fixed hfs strcpy overflow (bsc#1233615)\n- CVE-2024-45780: Fixed overflow in tar/cpio(bsc#1233614)\n- CVE-2024-45783: Fixed hfsplus refcount overflow (bsc#1233616)\n- CVE-2025-0624: Fixed out-of-bounds write in grub_net_search_config_file() (bsc#1236316)\n- CVE-2024-45774: Fixed heap overflows in JPEG parser (bsc#1233609)\n- CVE-2024-45775: Fixed missing NULL check in extcmd parser (bsc#1233610)\n- CVE-2025-0622: Fixed command/gpg: Use-after-free due to hooks not being removed on module unload (bsc#1236317)\n- CVE-2024-45776: Fixed overflow in .MO file (gettext) handling (bsc#1233612)\n- CVE-2024-45777: Fixed integer overflow in gettext (bsc#1233613)\n- CVE-2025-0690: Fixed integer overflow in read that may lead to out-of-bounds write (bsc#1237012)\n- CVE-2025-1118: Fixed commands/dump: The dump command is not in lockdown when secure boot is enabled(bsc#1237013)\n- CVE-2024-45778: Fixed bfs filesystem not fuzzing stable (bsc#1233606)\n- CVE-2024-45779: Fixed bfs heap overflow (bsc#1233608)\n- CVE-2025-0677: Fixed integer overflow that may lead to heap based\n  out-of-bounds write when handling symlinks in ufs (bsc#1237002)\n- CVE-2025-0684: Fixed reiserfs: Integer overflow when handling symlinks\n  may lead to heap based out-of-bounds write when reading data (bsc#1237008)\n- CVE-2025-0685: Fixed jfs: Integer overflow when handling symlinks may\n  lead to heap based out-of-bounds write when reading data (bsc#1237009)\n- CVE-2025-0686: Fixed romfs: Integer overflow when handling symlinks\n  may lead to heap based out-of-bounds write when reading data (bsc#1237010)\n- CVE-2025-0689: Fixed udf: Heap based buffer overflow  in\n  grub_udf_read_block() may lead to arbitrary code execution (bsc#1237011)\n- CVE-2025-1125: Fixed fs/hfs: Interger overflow may lead to heap based out-of-bounds write (bsc#1237014)\n- CVE-2025-0678: Fixed squash4: Integer overflow may lead to heap based out-of-bounds write when reading data (bsc#1237006)\n\n- Bump upstream SBAT generation to 5 to block older grub2 versions.\n\n- CVE-2024-49504: Fixed Bypassing TPM-bound disk encryption on SL(E)M encrypted Images (bsc#1229163) (bsc#1229164)\n\n- Restrict CLI access if the encrypted root device is automatically unlocked by\n  the TPM. LUKS password authentication is required for access to be granted\n- Obsolete, as CLI access is now locked and granted access no longer requires\n  the previous restrictions\n\n","status":"published","published":"2025-07-29T08:20:21Z","modified":"2026-03-23T04:50:09.963359Z","updated_at":"2026-11-02T15:53:59.92114Z"},{"id":"SUSE-SU-2025:20863-1","title":"Security update for grub2","description":"This update for grub2 fixes the following issues:\n\n- Fix error: /boot/grub2/x86_64-efi/bli.mod not found (bsc#1231591)\n\n- Fix OOM error in loading loopback file (bsc#1230840) (bsc#1249140)\n\n- Update the patch to fix \"SRK not matched\" errors when unsealing\n  the key (bsc#1232411) (bsc#1247242)\n\nSecurity fixes for 2024:\n\n- Bump upstream SBAT generation to 5\n\n- CVE-2024-45774: Fixed heap overflows in JPEG parser (bsc#1233609)\n- CVE-2024-45775: Fixed missing NULL check in extcmd parser (bsc#1233610)\n- CVE-2024-45776: Fixed overflow in .MO file (gettext) handling (bsc#1233612)\n- CVE-2024-45777: Fixed integer overflow in gettext (bsc#1233613)\n- CVE-2024-45778: Fixed bfs filesystem not fuzzing stable (bsc#1233606)\n- CVE-2024-45779: Fixed bfs heap overflow (bsc#1233608)\n- CVE-2024-45780: Fixed overflow in tar/cpio (bsc#1233614)\n- CVE-2024-45781: Fixed ufs strcpy overflow(bsc#1233617)\n- CVE-2024-45782: Fixed hfs strcpy overflow (bsc#1233615)\n- CVE-2024-45783: Fixed hfsplus refcount overflow (bsc#1233616)\n- CVE-2024-49504: Fixed bypassing TPM-bound disk encryption on SL(E)M\n  encrypted Images (bsc#1229163) (bsc#1229164)\n- CVE-2024-56737: Fixed heap-based buffer overflow in fs/hfs.c via\n  crafted sblock data in an HFS filesystem (bsc#1234958)\n- CVE-2024-56738: Fixed side-channel attack due to not constant-time\n  algorithm in grub_crypto_memcmp (bsc#1234959)\n- CVE-2025-0622: Fixed command/gpg use-after-free due to hooks not being\n  removed on module unload (bsc#1236317)\n- CVE-2025-0624: Fixed net Out-of-bounds write in grub_net_search_config_file() (bsc#1236316)\n- CVE-2025-0677: Fixed UFS integer overflow may lead to heap based\n  out-of-bounds write when handling symlinks (bsc#1237002)\n- CVE-2025-0678: Fixed squash4 Integer overflow may lead to heap based\n  out-of-bounds write when reading data (bsc#1237006)\n- CVE-2025-0684: Fixed reiserfs Integer overflow when handling symlinks\n  may lead to heap based out-of-bounds write when reading data (bsc#1237008)\n- CVE-2025-0685: Fixed jfs Integer overflow when handling symlinks may\n  lead to heap based out-of-bounds write when reading data (bsc#1237009)\n- CVE-2025-0686: Fixed romfs Integer overflow when handling symlinks\n  may lead to heap based out-of-bounds write when reading data (bsc#1237010)\n- CVE-2025-0689: Fixed udf heap based buffer overflow  in\n  grub_udf_read_block() may lead to arbitrary code execution (bsc#1237011)\n- CVE-2025-0690: Fixed \"read\" integer overflow may lead to out-of-bounds write (bsc#1237012)\n- CVE-2025-1118: Fixed commands/dump The dump command is not in lockdown when secure boot is enabled (bsc#1237013)\n- CVE-2025-1125: Fixed fs/hfs interger overflow may lead to heap based out-of-bounds write (bsc#1237014)\n- CVE-2025-4382: Fixed TPM auto-decryption data exposure (bsc#1242971)\n- Restrict CLI access if the encrypted root device is automatically unlocked by\n  the TPM. LUKS password authentication is required for access to be granted\n","status":"published","published":"2025-10-17T12:04:21Z","modified":"2026-03-23T04:51:03.18499Z","updated_at":"2026-11-02T15:53:59.92114Z"}]}}