[ubuntu/focal-updates] grub2-unsigned 2.04-1ubuntu47.5 (Accepted)
Steve Langasek
steve.langasek at canonical.com
Wed Jan 11 05:29:25 UTC 2023
grub2-unsigned (2.04-1ubuntu47.5) focal; urgency=medium
[ Chris Coulson ]
* SECURITY UPDATE: Fix out of bounds writes due specially crafted fonts.
- add debian/patches/font-Fix-several-integer-overflows-in-grub_font_construct.patch
- add debian/patches/font-Fix-an-integer-underflow-in-blit_comb.patch
- CVE-2022-2601, CVE-2022-3775
- LP: #1996950
* Fix various issues as a result of fuzzing, static analysis and code
review:
- add debian/patches/font-Reject-glyphs-exceeds-font-max_glyph_width-or-font-m.patch
- add debian/patches/font-Fix-size-overflow-in-grub_font_get_glyph_internal.patch
- add debian/patchces/font-Remove-grub_font_dup_glyph.patch
- add debian/patches/font-Fix-integer-overflow-in-ensure_comb_space.patch
- add debian/patches/font-Fix-integer-overflow-in-BMP-index.patch
- add debian/patches/font-Fix-integer-underflow-in-binary-search-of-char-index.patch
- add debian/patches/fbutil-Fix-integer-overflow.patch
- add debian/patches/font-Harden-grub_font_blit_glyph-and-grub_font_blit_glyph.patch
- add debian/patches/font-Assign-null_font-to-glyphs-in-ascii_font_glyph.patch
- add debian/patches/normal-charset-Fix-an-integer-overflow-in-grub_unicode_ag.patch
* Forbid loading of external fonts when secure boot is enabled:
- add debian/patches/font-Forbid-loading-of-font-files-when-secure-boot-is-ena.patch
* Bundle unicode.pf2 in a squashfs memdisk attached to the signed EFI binary
- update debian/control
- update debian/build-efi-image
- add debian/patches/font-Try-opening-fonts-from-the-bundled-memdisk.patch
* Fix the squashfs tests during the build
- remove debian/patches/ubuntu-fix-reproducible-squashfs-test.patch
- add debian/patches/tests-Explicitly-unset-SOURCE_DATE_EPOCH-before-running-f.patch
* Bump SBAT generation:
- update debian/sbat.ubuntu.csv.in
* Make grub-efi-{amd64,arm64} depend on grub2-common 2.02~beta2-36ubuntu3.33
in xenial and 2.02-2ubuntu8.25 in bionic to fix LP: #1995751 (thanks
Julian Klode for the base-files hack to make a single binary be able to
depend on 2 different versions of the same package)
[ dann frazier ]
* linuxefi: Invalidate i-cache before starting the kernel (LP: #1987924)
- d/p/linuxefi-Invalidate-i-cache-before-starting-the-kern.patch
Date: 2022-11-18 13:38:09.654394+00:00
Changed-By: Chris Coulson <chris.coulson at canonical.com>
Signed-By: Steve Langasek <steve.langasek at canonical.com>
https://launchpad.net/ubuntu/+source/grub2-unsigned/2.04-1ubuntu47.5
-------------- next part --------------
Sorry, changesfile not available.
More information about the Focal-changes
mailing list