Security update for grub2 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2015:2386-1 Final 1 1 2015-12-29T08:04:44Z current 2015-12-29T08:04:44Z 2015-12-29T08:04:44Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for grub2 This update for grub2 provides the following fixes: A security issues with a bufferoverflow when reading username and password was fixed (bsc#956631, CVE-2015-8370) Bugs fixed: - Expand list of grub.cfg search path in PV Xen guests for systems installed on btrfs snapshots. (bsc#946148, bsc#952539) - Add grub.xen config searching path on boot partition. (bsc#884828) - Add linux16 and initrd16 to grub.xen. (bsc#884830) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sledsp3-grub2-12287,slessp3-grub2-12287 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2015/suse-su-20152386-1/ Link for SUSE-SU-2015:2386-1 https://lists.opensuse.org/opensuse-security-announce/2015-12/msg00040.html E-Mail link for SUSE-SU-2015:2386-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/884828 SUSE Bug 884828 https://bugzilla.suse.com/884830 SUSE Bug 884830 https://bugzilla.suse.com/946148 SUSE Bug 946148 https://bugzilla.suse.com/952539 SUSE Bug 952539 https://bugzilla.suse.com/954592 SUSE Bug 954592 https://bugzilla.suse.com/956631 SUSE Bug 956631 https://www.suse.com/security/cve/CVE-2015-8370/ SUSE CVE CVE-2015-8370 page SUSE Linux Enterprise Desktop 11 SP3 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA SUSE Linux Enterprise Server for SAP Applications 11 SP3 grub2-x86_64-efi-2.00-0.49.2 grub2-x86_64-xen-2.00-0.49.2 grub2-x86_64-efi-2.00-0.49.2 as a component of SUSE Linux Enterprise Desktop 11 SP3 grub2-x86_64-xen-2.00-0.49.2 as a component of SUSE Linux Enterprise Desktop 11 SP3 grub2-x86_64-efi-2.00-0.49.2 as a component of SUSE Linux Enterprise Server 11 SP3 grub2-x86_64-xen-2.00-0.49.2 as a component of SUSE Linux Enterprise Server 11 SP3 grub2-x86_64-efi-2.00-0.49.2 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA grub2-x86_64-xen-2.00-0.49.2 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA grub2-x86_64-efi-2.00-0.49.2 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP3 grub2-x86_64-xen-2.00-0.49.2 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP3 Multiple integer underflows in Grub2 1.98 through 2.02 allow physically proximate attackers to bypass authentication, obtain sensitive information, or cause a denial of service (disk corruption) via backspace characters in the (1) grub_username_get function in grub-core/normal/auth.c or the (2) grub_password_get function in lib/crypto.c, which trigger an "Off-by-two" or "Out of bounds overwrite" memory error. CVE-2015-8370 SUSE Linux Enterprise Desktop 11 SP3:grub2-x86_64-efi-2.00-0.49.2 SUSE Linux Enterprise Desktop 11 SP3:grub2-x86_64-xen-2.00-0.49.2 SUSE Linux Enterprise Server 11 SP3-TERADATA:grub2-x86_64-efi-2.00-0.49.2 SUSE Linux Enterprise Server 11 SP3-TERADATA:grub2-x86_64-xen-2.00-0.49.2 SUSE Linux Enterprise Server 11 SP3:grub2-x86_64-efi-2.00-0.49.2 SUSE Linux Enterprise Server 11 SP3:grub2-x86_64-xen-2.00-0.49.2 SUSE Linux Enterprise Server for SAP Applications 11 SP3:grub2-x86_64-efi-2.00-0.49.2 SUSE Linux Enterprise Server for SAP Applications 11 SP3:grub2-x86_64-xen-2.00-0.49.2 moderate 6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20152386-1/ https://www.suse.com/security/cve/CVE-2015-8370.html CVE-2015-8370 https://bugzilla.suse.com/956631 SUSE Bug 956631