# SUSE-SU-2025:0586-1: grub2 security update SUSE-SU-2025:0586-1, released February 19, 2025, fixes 23 CVEs in grub2 (version 2.12-150600.8.18.2). None of them is reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/fix/linux/suse-su-2025-0586-1 - Platform: Linux - Released: Feb 19, 2025 - Priority: High (Closes CVE-2025-0624, high severity) - CVEs: 23, exploited: 0, on CISA KEV: 0 - Vendor advisory: https://osv.dev/vulnerability/SUSE-SU-2025:0586-1 ## Applies to | Product | Release | Fixed in | |---|---|---| | [grub2](https://patchblox.com/security/data/product/linux/grub2.md) | opensuse-leap 15.6 | 2.12-150600.8.18.2 | | [grub2](https://patchblox.com/security/data/product/linux/grub2.md) | sles 15.6 | 2.12-150600.8.18.2 | ## CVEs this fix closes | CVE | Priority | Title | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2025-0624](https://patchblox.com/security/data/cve/CVE-2025-0624.md) | High | grub2: Fixed an out-of-bounds write during the network boot process | 7.6 | 0.0141 | | | [CVE-2024-56737](https://patchblox.com/security/data/cve/CVE-2024-56737.md) | High | grub2: Fixed a heap-based buffer overflow in hfs | 8.8 | 0.0072 | | | [CVE-2025-0689](https://patchblox.com/security/data/cve/CVE-2025-0689.md) | High | grub2: Fixed a heap-based buffer overflow in udf that may lead to arbitrary code execution | 7.8 | 0.0050 | | | [CVE-2025-1125](https://patchblox.com/security/data/cve/CVE-2025-1125.md) | High | grub2: Fixed an integer overflow that may lead to an out-of-bounds write in hfs | 7.8 | 0.0045 | | | [CVE-2025-0678](https://patchblox.com/security/data/cve/CVE-2025-0678.md) | High | grub2: Fixed an integer overflow that may lead to an out-of-bounds write in squash4 | 7.8 | 0.0030 | | | [CVE-2024-45782](https://patchblox.com/security/data/cve/CVE-2024-45782.md) | High | grub2: Fixed strcpy overflow in hfs | 7.8 | 0.0023 | | | [CVE-2025-0690](https://patchblox.com/security/data/cve/CVE-2025-0690.md) | Routine | grub2: Fixed an integer overflow that may lead to an out-of-bounds write through the read command. | 6.7 | 0.0079 | | | [CVE-2025-0677](https://patchblox.com/security/data/cve/CVE-2025-0677.md) | Routine | grub2: Fixed an integer overflow that may lead to an out-of-bounds write when handling symlinks in ufs. | 6.7 | 0.0033 | | | [CVE-2024-49504](https://patchblox.com/security/data/cve/CVE-2024-49504.md) | Routine | grub2: Fixed an issue that can bypass TPM-bound disk encryption on SL(E)M encrypted Images | n/a | 0.0032 | | | [CVE-2025-1118](https://patchblox.com/security/data/cve/CVE-2025-1118.md) | Routine | grub2: Fixed an issue where the dump command was not being blocked when grub was in lockdown mode. | 6.7 | 0.0032 | | | [CVE-2024-45774](https://patchblox.com/security/data/cve/CVE-2024-45774.md) | Routine | grub2: Fixed a heap overflow in JPEG parser | 6.7 | 0.0031 | | | [CVE-2024-45776](https://patchblox.com/security/data/cve/CVE-2024-45776.md) | Routine | grub2: Fixed an overflow in .MO file handling | 6.7 | 0.0031 | | | [CVE-2024-45781](https://patchblox.com/security/data/cve/CVE-2024-45781.md) | Routine | grub2: Fixed strcpy overflow in ufs | 6.7 | 0.0031 | | | [CVE-2024-45778](https://patchblox.com/security/data/cve/CVE-2024-45778.md) | Routine | grub2: Fixed bfs filesystem by removing it from lockdown capable modules | 5.5 | 0.0029 | | | [CVE-2024-45777](https://patchblox.com/security/data/cve/CVE-2024-45777.md) | Routine | grub2: Fixed an integer overflow in gettext | 6.7 | 0.0029 | | | [CVE-2024-45780](https://patchblox.com/security/data/cve/CVE-2024-45780.md) | Routine | grub2: Fixed an overflow in tar/cpio | 6.7 | 0.0029 | | | [CVE-2024-45779](https://patchblox.com/security/data/cve/CVE-2024-45779.md) | Routine | grub2: Fixed a heap overflow in bfs | 6.0 | 0.0029 | | | [CVE-2024-45775](https://patchblox.com/security/data/cve/CVE-2024-45775.md) | Routine | grub2: Fixed a missing NULL check in extcmd parser | 6.7 | 0.0029 | | | [CVE-2025-0685](https://patchblox.com/security/data/cve/CVE-2025-0685.md) | Routine | grub2: Fixed an integer overflow that may lead to an out-of-bounds write when handling symlinks in jfs. | 6.4 | 0.0029 | | | [CVE-2025-0686](https://patchblox.com/security/data/cve/CVE-2025-0686.md) | Routine | grub2: Fixed an integer overflow that may lead to an out-of-bounds write when handling symlinks in romfs. | 6.4 | 0.0029 | | | [CVE-2025-0684](https://patchblox.com/security/data/cve/CVE-2025-0684.md) | Routine | grub2: Fixed an integer overflow that may lead to an out-of-bounds write when handling symlinks in reiserfs. | 6.4 | 0.0029 | | | [CVE-2025-0622](https://patchblox.com/security/data/cve/CVE-2025-0622.md) | Routine | grub2: Fixed a use-after-free when handling hooks during module unload in command/gpg | 6.7 | 0.0028 | | | [CVE-2024-45783](https://patchblox.com/security/data/cve/CVE-2024-45783.md) | Routine | grub2: Fixed a refcount overflow in hfsplus | 6.7 | 0.0028 | | --- Data as of 2026-11-11T19:49:26Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.