New GNU Boot 0.1 RC6 release
Quoting: GNU Boot - News [Savannah] —
Users having replaced the GNU Boot picture / logo with untrusted pictures could have been affected if the pictures they used were specially crafted to exploit a vulnerability in GRUB and take full control of the computer. In general it's a good idea to avoid using untrusted pictures in GRUB or other boot software to limit such risks because software can have bugs (a similar issue also happened in a free software UEFI implementation).
Users having implemented various user-respecting flavor(s) of secure-boot, either by using GPG signatures and/or by using a GRUB password combined with full disk encryption are also affected as these security vulnerabilities could enable people to bypass secure-boot schemes.
In addition there are also security vulnerabilities in file systems, which also enable execution of code. When booting, GRUB has to load files (like the Linux or linux-libre kernel) that are executed anyway. But in some cases, it could still affect users.