CVE-2022-3775

Name	CVE-2022-3775
Description	When rendering certain unicode sequences, grub2's font code doesn't proper validate if the informed glyph's width and height is constrained within bitmap size. As consequence an attacker can craft an input which will lead to a out-of-bounds write into grub2's heap, leading to memory corruption and availability issues. Although complex, arbitrary code execution could not be discarded.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-3190-1, DLA-3190-2, DSA-5280-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
grub2 (PTS)	buster	2.06-3~deb10u1	vulnerable
	buster (security)	2.06-3~deb10u4	fixed
	bullseye (security), bullseye	2.06-3~deb11u6	fixed
	bookworm, bookworm (security)	2.06-13+deb12u1	fixed
	trixie	2.12-2~deb13u1	fixed
	sid	2.12-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin
grub2	source	buster	2.06-3~deb10u3	DLA-3190-2
grub2	source	bullseye	2.06-3~deb11u4	DSA-5280-1
grub2	source	(unstable)	2.06-5

https://lists.gnu.org/archive/html/grub-devel/2022-11/msg00059.html