There is an issue on grub2 before version 2.06 at function
read_section_as_string(). It expects a font name to be at max UINT32_MAX -
1 length in bytes but it doesn't verify it before proceed with buffer
allocation to read the value from the font value. An attacker may leverage
that by crafting a malicious font file which has a name with UINT32_MAX,
leading to read_section_as_string() to an arithmetic overflow, zero-sized
allocation and further heap-based buffer overflow.

Chris Coulson discovered that multiple integer overflows existed in GRUB2
when handling certain filesystems or font files, leading to heap-based
buffer overflows. A local attacker could use these to execute arbitrary
code and bypass UEFI Secure Boot restrictions.

amurray

grub2-signed is not supported in Ubuntu 12.04 ESM (precise/esm) and so marking the priority for grub2 in this release as low