Skip to content
Sign in
Not rated

CVE-2020-14309 There's an issue with grub2 in all versions before 2.06 when handling squashfs filesystems containing a symbolic link…

Description

There's an issue with grub2 in all versions before 2.06 when handling squashfs filesystems containing a symbolic link with name length of UINT32 bytes in size. The name size leads to an arithmetic overflow leading to a zero-size allocation further causing a heap-based buffer overflow with attacker controlled data.

Affected products and versions

Product Affected versions Fixed in
Grub Versions not published

Other CVEs of Grub

The 3 CVEs of Grub →
CVE-2020-10713 A flaw was found in grub2, prior to version 2.06 Not rated CVE-2020-14308 In grub2 versions before 2.06 the grub memory allocator doesn't check for possible arithmetic overflows on the requested… Not rated
Track this CVE