CVE catalog
CVE-2008-3896
grub affected and fixed versions
Grub Legacy 0.97 and earlier stores pre-boot authentication passwords in the BIOS Keyboard buffer and does not clear this buffer before and after use, which allows local users to obtain sensitive information by reading the physical memory locations associated with this buffer.
- Severity
- Low
- Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.35% · Oct 27, 2026
Reported versions and fixes
Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.
| Distribution / release | Package | Version | Status | Source |
|---|---|---|---|---|
| Debiantrixie | grub | Not reported | AffectedDistribution reports no fix | [CVE-2008-3896] |
| Debiantrixie | grub | 0.97-84 | Affected | [CVE-2008-3896] |
| Debianbookworm | grub | Not reported | AffectedDistribution reports no fix | [CVE-2008-3896] |
| Debianbookworm | grub | 0.97-80 | Affected | [CVE-2008-3896] |
| UnknownRelease not reported | grub | Not reported | UnknownSource applicability is not established | Provider not reported |
Provider details and historical evidence
| Distribution / release | Package | Version | Status | Source |
|---|---|---|---|---|
| UnknownRelease not reported | grub | Not reported | UnknownSource applicability is not established | Provider not reported |
| Debianbookworm | grub | Not reported | AffectedDistribution reports no fix | [CVE-2008-3896] |
| Debianbookworm | grub | 0.97-80 | Affected | [CVE-2008-3896] |
| Debiantrixie | grub | Not reported | AffectedDistribution reports no fix | [CVE-2008-3896] |
| Debiantrixie | grub | 0.97-84 | Affected | [CVE-2008-3896] |
Original provider fields
{
"package_releases": [
{
"name": "grub",
"status": "vulnerable",
"release": "trixie",
"version": "0.97-84"
},
{
"name": "grub",
"status": "vulnerable",
"release": "bookworm",
"version": "0.97-80"
}
],
"fixed_versions": [
{
"bug": null,
"name": "grub",
"type": "source",
"origin": null,
"release": "trixie",
"urgency": "unimportant",
"fixed_version": ""
},
{
"bug": null,
"name": "grub",
"type": "source",
"origin": null,
"release": "bookworm",
"urgency": "unimportant",
"fixed_version": ""
}
],
"distribution_packages": [
{
"name": "grub",
"fixed_version": "not yet fixed",
"applicability_unknown": true
}
]
}OpenFactory catalog packages
Matching against OpenFactory catalog package versions is in progress.
[Debian 12 (Bookworm)]
- [grub-legacy]Unknown
Source package: [grub]
Details (1)
0.97-80· amd64 · bookwormAffected
dsa · grub · debian · bookworm; dsa · grub · debian · 12
- [grub-legacy-doc]Unknown
Source package: [grub]
Details (2)
0.97-80· all · bookwormAffected
dsa · grub · debian · bookworm; dsa · grub · debian · 12
0.97-80· all · bookwormAffected
dsa · grub · debian · bookworm; dsa · grub · debian · 12
[Debian 13 (Trixie)]
- [grub-legacy]Unknown
Source package: [grub]
Details (1)
0.97-84· amd64 · trixieAffected
dsa · grub · debian · 13
Observed: