Test ID:	1.3.6.1.4.1.25623.1.1.4.2020.2079.1
Category:	SuSE Local Security Checks
Title:	SUSE: Security Advisory (SUSE-SU-2020:2079-1)
Summary:	The remote host is missing an update for the 'grub2' package(s) announced via the SUSE-SU-2020:2079-1 advisory.
Description:	Summary: The remote host is missing an update for the 'grub2' package(s) announced via the SUSE-SU-2020:2079-1 advisory. Vulnerability Insight: This update for grub2 fixes the following issues: - Fix for CVE-2020-10713 (bsc#1168994) - Fix for CVE-2020-14308 CVE-2020-14309, CVE-2020-14310, CVE-2020-14311 (bsc#1173812) - Fix for CVE-2020-15706 (bsc#1174463) - Fix for CVE-2020-15707 (bsc#1174570) - Use overflow checking primitives where the arithmetic expression for buffer allocations may include unvalidated data - Use grub_calloc for overflow check and return NULL when it would occur - Use gcc-9 compiler for overflow check builtins - Backport gcc-9 build fixes - Fix packed-not-aligned error on GCC 8 (bsc#1084632) Affected Software/OS: 'grub2' package(s) on SUSE Linux Enterprise Server 12-SP3, SUSE Linux Enterprise Server for SAP Applications 12-SP3. Solution: Please install the updated package(s). CVSS Score: 4.6 CVSS Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2020-10713 CERT/CC vulnerability note: VU#174059 https://www.kb.cert.org/vuls/id/174059 Cisco Security Advisory: 20200804 GRUB2 Arbitrary Code Execution Vulnerability https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-grub2-code-exec-xLePCAPY Debian Security Information: DSA-4735 (Google Search) https://www.debian.org/security/2020/dsa-4735 https://security.gentoo.org/glsa/202104-05 https://cve.openeuler.org/#/CVEInfo/CVE-2020-10713 https://eclypsium.com/2020/07/29/theres-a-hole-in-the-boot/ https://kb.vmware.com/s/article/80181 https://bugzilla.redhat.com/show_bug.cgi?id=1825243 http://www.openwall.com/lists/oss-security/2020/07/29/3 SuSE Security Announcement: openSUSE-SU-2020:1168 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00016.html SuSE Security Announcement: openSUSE-SU-2020:1169 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00017.html https://usn.ubuntu.com/4432-1/ Common Vulnerability Exposure (CVE) ID: CVE-2020-14308 https://bugzilla.redhat.com/show_bug.cgi?id=1852009 http://www.openwall.com/lists/oss-security/2021/09/17/2 http://www.openwall.com/lists/oss-security/2021/09/17/4 http://www.openwall.com/lists/oss-security/2021/09/21/1 Common Vulnerability Exposure (CVE) ID: CVE-2020-14309 https://bugzilla.redhat.com/show_bug.cgi?id=1852022 Common Vulnerability Exposure (CVE) ID: CVE-2020-14310 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14310 Common Vulnerability Exposure (CVE) ID: CVE-2020-14311 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14311 Common Vulnerability Exposure (CVE) ID: CVE-2020-15706 https://lists.gnu.org/archive/html/grub-devel/2020-07/msg00034.html https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV200011 https://www.eclypsium.com/2020/07/29/theres-a-hole-in-the-boot/ https://www.openwall.com/lists/oss-security/2020/07/29/3 Debian Security Information: https://www.debian.org/security/2020-GRUB-UEFI-SecureBoot (Google Search) https://www.debian.org/security/2020-GRUB-UEFI-SecureBoot RedHat Security Advisories: https://access.redhat.com/security/vulnerabilities/grub2bootloader https://access.redhat.com/security/vulnerabilities/grub2bootloader SuSE Security Announcement: https://www.suse.com/c/suse-addresses-grub2-secure-boot-issue/ (Google Search) https://www.suse.com/c/suse-addresses-grub2-secure-boot-issue/ SuSE Security Announcement: https://www.suse.com/support/kb/doc/?id=000019673 (Google Search) https://www.suse.com/support/kb/doc/?id=000019673 http://ubuntu.com/security/notices/USN-4432-1 https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/GRUB2SecureBootBypass Common Vulnerability Exposure (CVE) ID: CVE-2020-15707
Copyright	Copyright (C) 2021 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.