SUSE-SU-2015:2387-1

    Dashboard / Vulnerabilities / SUSE-SU-2015:2387-1

    SUSE-SU-2015:2387-1

    Published: 29 Dec 2015Last Modified: 4 Feb 2026
    Upstream:
    CVE-2015-8370
    Aliases:
    CVE-2015-8370

    Summary: Security update for grub2

    Details: - Fix buffer overflows when reading username and password. (bsc#956631, CVE-2015-8370) - Check MS-DOS header to find PE file header. (bsc#954126) - Use dirname for copying Xen kernel and initrd to esp. (bsc#955493) - Fix reading password by grub2-mkpasswd-pbdk2 without controlling tty. (bsc#954519) - Add luks, gcry_rijndael and gcry_sha1 to signed EFI image to support LUKS partition in default setup. (bsc#917427, bsc#955609) - Expand list of grub.cfg search path in PV Xen guests for systems installed on btrfs snapshots. (bsc#946148, bsc#952539)

    References: https://www.suse.com/support/update/announcement/2015/suse-su-20152387-1/, https://bugzilla.suse.com/774666, https://bugzilla.suse.com/917427, https://bugzilla.suse.com/946148, https://bugzilla.suse.com/952539, https://bugzilla.suse.com/954126, https://bugzilla.suse.com/954519, https://bugzilla.suse.com/955493, https://bugzilla.suse.com/955609, https://bugzilla.suse.com/956631, https://www.suse.com/security/cve/CVE-2015-8370

    Affected packages

    Package

    Name: grub2

    Purl: pkg:rpm/suse/grub2&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP1

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -2.02~beta2-73.3

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    SUSE-SU-2015:2387-1 | CVE-DB