Back Linuxsecurity openSUSE Leap 15.5: SUSE-SU-2025:4152-1 CVE-2025
This update for grub2 fixes the following issues: * CVE-2025-54771: Fixed rub_file_close() does not properly controls the fs refcount (bsc#1252931) * CVE-2025-61662: Fixed missing unregister call for gettext command may lead to use-after-free (bsc#1252933) * CVE-2025-61663: Fixed missing unregister call for normal commands may lead to use-after-free (bsc#1252934) * CVE-2025-61664: Fixed missing unregister call for normal_exit command may lead to use-after-free (bsc#1252935) * CVE-2025-61661: Fixed out-of-bounds write in grub_usb_get_string() function (bsc#1252932) Other fixes: * Bump upstream SBAT generation to 6
## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch SUSE-2025-4152=1 * SUSE Linux Enterprise Micro 5.5 zypper in -t patch SUSE-SLE-Micro-5.5-2025-4152=1
## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch SUSE-2025-4152=1 * SUSE Linux Enterprise Micro 5.5 zypper in -t patch SUSE-SLE-Micro-5.5-2025-4152=1
* openSUSE Leap 15.5 (aarch64 s390x x86_64 i586) * grub2-debugsource-2.06-150500.29.59.1 * openSUSE Leap 15.5 (noarch) * grub2-i386-pc-2.06-150500.29.59.1 * grub2-i386-xen-debug-2.06-150500.29.59.1 * grub2-powerpc-ieee1275-2.06-150500.29.59.1 * grub2-arm64-efi-debug-2.06-150500.29.59.1 * grub2-x86_64-efi-2.06-150500.29.59.1 * grub2-i386-efi-2.06-150500.29.59.1 * grub2-i386-efi-extras-2.06-150500.29.59.1 * grub2-i386-pc-extras-2.06-150500.29.59.1 * grub2-x86_64-efi-extras-2.06-150500.29.59.1 * grub2-i386-xen-extras-2.06-150500.29.59.1 * grub2-powerpc-ieee1275-extras-2.06-150500.29.59.1 * grub2-i386-xen-2.06-150500.29.59.1 * grub2-arm64-efi-2.06-150500.29.59.1 * grub2-i386-pc-debug-2.06-150500.29.59.1 * grub2-s390x-emu-extras-2.06-150500.29.59.1 * grub2-snapper-plugin-2.06-150500.29.59.1 * grub2-powerpc-ieee1275-debug-2.06-150500.29.59.1 * grub2-x86_64-efi-debug-2.06-150500.29.59.1 * grub2-x86_64-xen-extras-2.06-150500.29.59.1 * grub2-x86_64-xen-debug-2.06-150500.29.59.1 * grub2-x86_64-xen-2.06-150500.29.59.1 * grub2-i386-efi-debug-2.06-150500.29.59.1 * grub2-systemd-sleep-plugin-2.06-150500.29.59.1 * grub2-arm64-efi-extras-2.06-150500.29.59.1 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64 i586) * grub2-branding-upstream-2.06-150500.29.59.1 * grub2-debuginfo-2.06-150500.29.59.1 * grub2-2.06-150500.29.59.1 * openSUSE Leap 15.5 (s390x) * grub2-s390x-emu-debug-2.06-150500.29.59.1 * grub2-s390x-emu-2.06-150500.29.59.1 * SUSE Linux Enterprise Micro 5.5 (aarch64 ppc64le s390x x86_64) * grub2-debuginfo-2.06-150500.29.59.1 * grub2-2.06-150500.29.59.1 * SUSE Linux Enterprise Micro 5.5 (noarch) * grub2-snapper-plugin-2.06-150500.29.59.1 * grub2-i386-pc-2.06-150500.29.59.1 * grub2-powerpc-ieee1275-2.06-150500.29.59.1 * grub2-x86_64-efi-2.06-150500.29.59.1 * grub2-arm64-efi-2.06-150500.29.59.1 * grub2-x86_64-xen-2.06-150500.29.59.1 * SUSE Linux Enterprise Micro 5.5 (aarch64 s390x x86_64) * grub2-debugsource-2.06-150500.29.59.1 * SUSE Linux Enterprise Micro 5.5 (s390x) * grub2-s390x-emu-2.06-150500.29.59.1
* openSUSE Leap 15.5 (aarch64 s390x x86_64 i586) * grub2-debugsource-2.06-150500.29.59.1 * openSUSE Leap 15.5 (noarch) * grub2-i386-pc-2.06-150500.29.59.1 * grub2-i386-xen-debug-2.06-150500.29.59.1 * grub2-powerpc-ieee1275-2.06-150500.29.59.1 * grub2-arm64-efi-debug-2.06-150500.29.59.1 * grub2-x86_64-efi-2.06-150500.29.59.1 * grub2-i386-efi-2.06-150500.29.59.1 * grub2-i386-efi-extras-2.06-150500.29.59.1 * grub2-i386-pc-extras-2.06-150500.29.59.1 * grub2-x86_64-efi-extras-2.06-150500.29.59.1 * grub2-i386-xen-extras-2.06-150500.29.59.1 * grub2-powerpc-ieee1275-extras-2.06-150500.29.59.1 * grub2-i386-xen-2.06-150500.29.59.1 * grub2-arm64-efi-2.06-150500.29.59.1 * grub2-i386-pc-debug-2.06-150500.29.59.1 * grub2-s390x-emu-extras-2.06-150500.29.59.1 * grub2-snapper-plugin-2.06-150500.29.59.1 * grub2-powerpc-ieee1275-debug-2.06-150500.29.59.1 * grub2-x86_64-efi-debug-2.06-150500.29.59.1 * grub2-x86_64-xen-extras-2.06-150500.29.59.1 * grub2-x86_64-xen-debug-2.06-150500.29.59.1 * grub2-x86_64-xen-2.06-150500.29.59.1 * grub2-i386-efi-debug-2.06-150500.29.59.1 * grub2-systemd-sleep-plugin-2.06-150500.29.59.1 * grub2-arm64-efi-extras-2.06-150500.29.59.1 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64 i586) * grub2-branding-upstream-2.06-150500.29.59.1 * grub2-debuginfo-2.06-150500.29.59.1 * grub2-2.06-150500.29.59.1 * openSUSE Leap 15.5 (s390x) * grub2-s390x-emu-debug-2.06-150500.29.59.1 * grub2-s390x-emu-2.06-150500.29.59.1 * SUSE Linux Enterprise Micro 5.5 (aarch64 ppc64le s390x x86_64) * grub2-debuginfo-2.06-150500.29.59.1 * grub2-2.06-150500.29.59.1 * SUSE Linux Enterprise Micro 5.5 (noarch) * grub2-snapper-plugin-2.06-150500.29.59.1 * grub2-i386-pc-2.06-150500.29.59.1 * grub2-powerpc-ieee1275-2.06-150500.29.59.1 * grub2-x86_64-efi-2.06-150500.29.59.1 * grub2-arm64-efi-2.06-150500.29.59.1 * grub2-x86_64-xen-2.06-150500.29.59.1 * SUSE Linux Enterprise Micro 5.5 (aarch64 s390x x86_64) * grub2-debugsource-2.06-150500.29.59.1 * SUSE Linux Enterprise Micro 5.5 (s390x) * grub2-s390x-emu-2.06-150500.29.59.1
* bsc#1252931 * bsc#1252932 * bsc#1252933 * bsc#1252934 * bsc#1252935 ## References: * * * * * * * * * *
* bsc#1252931 * bsc#1252932 * bsc#1252933 * bsc#1252934 * bsc#1252935 ## References: * * * * * * * * * *
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
