CVE-2017-9763

Name	CVE-2017-9763
Description	The grub_ext2_read_block function in fs/ext2.c in GNU GRUB before 2013-11-12, as used in shlr/grub/fs/ext2.c in radare2 1.5.0, allows remote attackers to cause a denial of service (excessive stack use and application crash) via a crafted binary file, related to use of a variable-size stack array.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	869423

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
grub2 (PTS)	bookworm	2.06-13+deb12u2	fixed
	bookworm (security)	2.06-13+deb12u1	fixed
	trixie	2.12-9+deb13u2	fixed
	forky, sid	2.14-3	fixed
radare2 (PTS)	sid	6.1.8+ds-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
grub2	source	(unstable)	2.02~beta2-8	unimportant
radare2	source	(unstable)	1.6.0+dfsg-1			869423

Notes

[jessie] - radare2 <no-dsa> (Minor issue)
[wheezy] - radare2 <no-dsa> (Minor issue)
https://github.com/radare/radare2/commit/65000a7fd9eea62359e6d6714f17b94a99a82edd
https://github.com/radare/radare2/issues/7723
Not a security issue for Grub