7.1
High
CVE-2022-3775 When rendering certain unicode sequences, grub2's font code doesn't proper validate if the informed glyph's width and…
Description
When rendering certain unicode sequences, grub2's font code doesn't proper validate if the informed glyph's width and height is constrained within bitmap size. As consequence an attacker can craft an input which will lead to a out-of-bounds write into grub2's heap, leading to memory corruption and availability issues. Although complex, arbitrary code execution could not be discarded.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| grub2 | Versions not published |
References
- access.redhat.com access.redhat.com
- GLSA-202311-14 security.gentoo.org
Timeline
- Published
- Last modified
Other CVEs of grub2
The 14 CVEs of grub2 →
CVE-2022-2601
A buffer overflow was found in grub_font_construct_glyph()
8.6
High
CVE-2021-3697
A crafted JPEG image may lead the JPEG reader to underflow its data pointer, allowing user-controlled data to be written…
Not rated
CVE-2021-3696
A heap out-of-bounds write may heppen during the handling of Huffman tables in the PNG reader
Not rated
CVE-2021-3695
A crafted 16-bit grayscale PNG image may lead to a out-of-bounds write in the heap area
Not rated