Skip to content
OpenAdvisories
Medium ELSA-2015-2623 1 CVE

Moderate: grub2 security and bug fix update (Oracle Linux 7)

Published Dec 15, 2015 · Updated Dec 15, 2015

Summary

[2.02-0.33.0.1]
- Fix comparison in patch for 18504756
- Remove symlink to grub environment file during uninstall on EFI platforms
[bug 19231481]
- update Oracle Linux certificates (Alexey Petrenko)
- Put 'with' in menuentry instead of 'using' [bug 18504756]
- Use different titles for UEK and RHCK kernels [bug 18504756]

[2.02-0.33]
- Don't remove 01_users, it's the wrong thing to do.
Related:rhbz1290089

[2.02-0.32]
- Rebuild for .z so the release number is different.
Related: rhbz#1290089

[2.02-0.31]
- More work on handling of GRUB2_PASSWORD
Resolves: rhbz#1290089

[2.02-0.30]
- Fix security issue when reading username and password
Resolves: CVE-2015-8370
- Do a better job of handling GRUB_PASSWORD
Resolves: rhbz#1290089

Fixed packages 4

ReleasePackageFixed in
Oracle Linux · 7 grub2 1:2.02-0.33.0.1.el7_2
Oracle Linux · 7 grub2-efi 1:2.02-0.33.0.1.el7_2
Oracle Linux · 7 grub2-efi-modules 1:2.02-0.33.0.1.el7_2
Oracle Linux · 7 grub2-tools 1:2.02-0.33.0.1.el7_2

Vulnerabilities 1

  • High 7.4

    Multiple integer underflows in Grub2 1.98 through 2.02 allow physically proximate attackers to bypass authentication, o…