GNU GRUB - Bugs: bug #42635, minilzo: Embedded LZO...
You are not allowed to post comments on this tracker with your current authentication level.
bug #42635: minilzo: Embedded LZO vulnerability (CVE-2014-4607)
Submitter: | Kristian Fiskerstrand <kristianf> | ||
Submitted: | Fri 27 Jun 2014 04:06:24 PM UTC | ||
Category: | Security | Severity: | Major |
Priority: | 5 - Normal | Item Group: | None |
Status: | None | Privacy: | Public |
Assigned to: | None | Originator Name: | |
Open/Closed: | Open | Release: | Git master |
Release: | Reproducibility: | None | |
Planned Release: | 2.02 |
Fri 27 Jun 2014 04:48:35 PM UTC, comment #1: |
Vladimir Serbinenko <phcoder> |
Fri 27 Jun 2014 04:06:24 PM UTC, original submission:
Hi,
|
Kristian Fiskerstrand <kristianf> |
No files currently attached
Depends on the following items: None found
Items that depend on this one: None found
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
Follows 1 latest change.
Date | Changed by | Updated Field | Previous Value | => | Replaced by |
---|---|---|---|---|---|
2016-03-02 | phcoder | Planned Release | None | 2.02 |
Powered by Savane 3.13-4448.
Corresponding source code
May be a problem when using btrfs with lzo compression. But it's unlikely. If attacker can write to files used by GRUB, you have a bigger problems.
In cases when signatures used (if disk replacement is a possible attack scenario), the signatures are checked before the decompression, so not a problem either.
Nevertheless, I'll correct the mistake, thank you for forwarding this.