SUSE-SU-2025:20863-1: grub2&distro=SUSE Linux Micro 6.1 SUSE Linux Enterprise

Vulnerability summary

SUSE-SU-2025:20863-1 is a vulnerability in grub2&distro=SUSE Linux Micro 6.1 SUSE Linux Enterprise with no CVSS score yet.

Timeline

1. 17-10-2025
   PublishedVulnerability first disclosed.
2. 23-03-2026
   Last modifiedVulnerability information updated.

Description

Security update for grub2 This update for grub2 fixes the following issues: - Fix error: /boot/grub2/x86_64-efi/bli.mod not found (bsc#1231591) - Fix OOM error in loading loopback file (bsc#1230840) (bsc#1249140) - Update the patch to fix "SRK not matched" errors when unsealing the key (bsc#1232411) (bsc#1247242) Security fixes for 2024: - Bump upstream SBAT generation to 5 - CVE-2024-45774: Fixed heap overflows in JPEG parser (bsc#1233609) - CVE-2024-45775: Fixed missing NULL check in extcmd parser (bsc#1233610) - CVE-2024-45776: Fixed overflow in .MO file (gettext) handling (bsc#1233612) - CVE-2024-45777: Fixed integer overflow in gettext (bsc#1233613) - CVE-2024-45778: Fixed bfs filesystem not fuzzing stable (bsc#1233606) - CVE-2024-45779: Fixed bfs heap overflow (bsc#1233608) - CVE-2024-45780: Fixed overflow in tar/cpio (bsc#1233614) - CVE-2024-45781: Fixed ufs strcpy overflow(bsc#1233617) - CVE-2024-45782: Fixed hfs strcpy overflow (bsc#1233615) - CVE-2024-45783: Fixed hfsplus refcount overflow (bsc#1233616) - CVE-2024-49504: Fixed bypassing TPM-bound disk encryption on SL(E)M encrypted Images (bsc#1229163) (bsc#1229164) - CVE-2024-56737: Fixed heap-based buffer overflow in fs/hfs.c via crafted sblock data in an HFS filesystem (bsc#1234958) - CVE-2024-56738: Fixed side-channel attack due to not constant-time algorithm in grub_crypto_memcmp (bsc#1234959) - CVE-2025-0622: Fixed command/gpg use-after-free due to hooks not being removed on module unload (bsc#1236317) - CVE-2025-0624: Fixed net Out-of-bounds write in grub_net_search_config_file() (bsc#1236316) - CVE-2025-0677: Fixed UFS integer overflow may lead to heap based out-of-bounds write when handling symlinks (bsc#1237002) - CVE-2025-0678: Fixed squash4 Integer overflow may lead to heap based out-of-bounds write when reading data (bsc#1237006) - CVE-2025-0684: Fixed reiserfs Integer overflow when handling symlinks may lead to heap based out-of-bounds write when reading data (bsc#1237008) - CVE-2025-0685: Fixed jfs Integer overflow when handling symlinks may lead to heap based out-of-bounds write when reading data (bsc#1237009) - CVE-2025-0686: Fixed romfs Integer overflow when handling symlinks may lead to heap based out-of-bounds write when reading data (bsc#1237010) - CVE-2025-0689: Fixed udf heap based buffer overflow in grub_udf_read_block() may lead to arbitrary code execution (bsc#1237011) - CVE-2025-0690: Fixed "read" integer overflow may lead to out-of-bounds write (bsc#1237012) - CVE-2025-1118: Fixed commands/dump The dump command is not in lockdown when secure boot is enabled (bsc#1237013) - CVE-2025-1125: Fixed fs/hfs interger overflow may lead to heap based out-of-bounds write (bsc#1237014) - CVE-2025-4382: Fixed TPM auto-decryption data exposure (bsc#1242971) - Restrict CLI access if the encrypted root device is automatically unlocked by the TPM. LUKS password authentication is required for access to be granted

No weakness data has been published for this record.