ELSA-2026-5233

Опубликовано: 08 апр. 2026

Источник: oracle-oval

Платформа: Oracle Linux 7

Описание

ELSA-2026-5233: grub2 security update (MODERATE)

[2.02-0.87.0.29.el7.14]

Unregister gettext command on module unload [CVE-2025-61662][Orabug: 39112125]

[2.02-0.87.0.27.el7.14]

Fix OOB write in grub_net_search_config_file() CVE-2025-0624 [Orabug: 37770226]
Also adds implementation of grub_strlcpy() for clean backport

[2.02-0.87.0.26.el7.14]

Replace bugzilla.oracle.com reference [Orabug: 35477723]
Backport kernel EFI allocation pacthes [Orabug: 34301086]
Add to the list CVE-2021-3695, CVE-2021-3696, CVE-2021-3697, CVE-2022-28734, CVE-2022-28735, CVE-2022-28736 [JIRA: OLDIS-16371]
bump SBAT generation [JIRA: OLDIS-16371]
Cleanup XEN shell script (Alex Burmashev) [Orabug: 33851417]
Update SBAT data (Alex Burmashev) [Orabug: 33851417]
efinet: change SNP open call (Alex Burmashev) [Orabug: 32646964]
disable buggy 0183-efinet-retransmit-if-our-device-is-busy.patch [Orabug: 27982684]
Patch multiboot2 to the recent state [Orabug: 32950597]
Enable multiboot2 for UEFI ( non Secureboot ) mode [Orabug: 32950597]
Update signing certificate [Orabug: 32670043]
Update shim and certificates dependencies [Orabug: 32670043]
xfs: Don't attempt to iterate over empty directory [Orabug: 32584717]
add SBAT metadata for Oracle Linux grub2
Use similar format for menu entry in grub environment block
config file. [Orabug: 32172943]
Fix degradation in multiboot2 code [Orabug: 32069510]
Update signing certificate for efi binaries
Update upstream references [Orabug: 30138841]
Restore symlink to grub environment file, that was removed during grub2-efi update if grub2 package is also installed on UEFI machines [Orabug: 27345750]
fix symlink removal scriptlet, to be executed only on removal [Orabug: 19231481]
Fix comparison in patch for [Orabug: 18504756]
Remove symlink to grub environment file during uninstall on EFI platforms [Orabug: 19231481]
replace dynamic EFI boot folder path generation with predefined 'redhat' (Alex Burmashev)
Put 'with' in menuentry instead of 'using' [Orabug: 18504756]
Use different titles for UEK and RHCK kernels [Orabug: 18504756]

[2.02-087.el7.14]

Rebuild for signing
Related: RHEL-23460

[2.02-087.el7.13]

safemath: add grub_cast for gcc < 5.1
Related: RHEL-23460

[2.02-087.el7.12]

Font CVE fixes and bump SBAT (CVE-2022-2601)
Resolves: RHEL-23460

[2.02-087.el7.11]

Bump sbat
Resolves: CVE-2022-28733

[2.02-087.el7.10]

Backport the relevant CVE fixes from the 2022-05-24 drop
Resolves: CVE-2022-28733

[2.02-087.el7.9]

Bump for signing
Resolves: #1892860

[2.02-0.87.el7.8]

Fix accidental reboot in grub_exit
Resolves: #1892860

Обновленные пакеты

Oracle Linux 7

Oracle Linux x86_64

grub2

2.02-0.87.0.29.el7_9.14

grub2-common

2.02-0.87.0.29.el7_9.14

grub2-efi-ia32

2.02-0.87.0.29.el7_9.14

grub2-efi-ia32-cdboot

2.02-0.87.0.29.el7_9.14

grub2-efi-ia32-modules

2.02-0.87.0.29.el7_9.14

grub2-efi-x64

2.02-0.87.0.29.el7_9.14

grub2-efi-x64-cdboot

2.02-0.87.0.29.el7_9.14

grub2-efi-x64-modules

2.02-0.87.0.29.el7_9.14

grub2-pc

2.02-0.87.0.29.el7_9.14

grub2-pc-modules

2.02-0.87.0.29.el7_9.14

grub2-tools

2.02-0.87.0.29.el7_9.14

grub2-tools-extra

2.02-0.87.0.29.el7_9.14

grub2-tools-minimal

2.02-0.87.0.29.el7_9.14

Связанные CVE

CVE-2025-61662

Ссылки на источники

Связанные уязвимости

CVE-2025-61662

CVSS3: 7.8

ubuntu

8 месяцев назад

A Use-After-Free vulnerability has been discovered in GRUB's gettext module. This flaw stems from a programming error where the gettext command remains registered in memory after its module is unloaded. An attacker can exploit this condition by invoking the orphaned command, causing the application to access a memory location that is no longer valid. An attacker could exploit this vulnerability to cause grub to crash, leading to a Denial of Service. Possible data integrity or confidentiality compromise is not discarded.