diff -Nru grub2-2.02~beta2/debian/changelog grub2-2.02~beta2/debian/changelog
--- grub2-2.02~beta2/debian/changelog	2015-11-25 20:13:35.000000000 +0000
+++ grub2-2.02~beta2/debian/changelog	2015-12-15 14:11:32.000000000 +0000
@@ -1,3 +1,13 @@
+grub2 (2.02~beta2-9ubuntu1.6) trusty-security; urgency=medium
+
+  * SECURITY UPDATE: password bypass via backspace key buffer overflow
+    - debian/patches/CVE-2015-8370.patch: check length before accepting a
+      backspace character in grub-core/lib/crypto.c,
+      grub-core/normal/auth.c.
+    - CVE-2015-8370
+
+ -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 15 Dec 2015 09:11:24 -0500
+
 grub2 (2.02~beta2-9ubuntu1.5) trusty; urgency=medium
 
   * d/p/arm64-set-correct-length-of-device-path-end-entry.patch: Fixes
diff -Nru grub2-2.02~beta2/debian/patches/CVE-2015-8370.patch grub2-2.02~beta2/debian/patches/CVE-2015-8370.patch
--- grub2-2.02~beta2/debian/patches/CVE-2015-8370.patch	1970-01-01 00:00:00.000000000 +0000
+++ grub2-2.02~beta2/debian/patches/CVE-2015-8370.patch	2015-12-15 14:11:20.000000000 +0000
@@ -0,0 +1,44 @@
+From 88c9657960a6c5d3673a25c266781e876c181add Mon Sep 17 00:00:00 2001
+From: Hector Marco-Gisbert <hecmargi@upv.es>
+Date: Fri, 13 Nov 2015 16:21:09 +0100
+Subject: [PATCH] Fix security issue when reading username and password
+
+  This patch fixes two integer underflows at:
+    * grub-core/lib/crypto.c
+    * grub-core/normal/auth.c
+
+Resolves: CVE-2015-8370
+
+Signed-off-by: Hector Marco-Gisbert <hecmargi@upv.es>
+Signed-off-by: Ismael Ripoll-Ripoll <iripoll@disca.upv.es>
+---
+ grub-core/lib/crypto.c  | 2 +-
+ grub-core/normal/auth.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+Index: grub2-2.02~beta2/grub-core/lib/crypto.c
+===================================================================
+--- grub2-2.02~beta2.orig/grub-core/lib/crypto.c	2015-12-15 08:45:31.307836075 -0500
++++ grub2-2.02~beta2/grub-core/lib/crypto.c	2015-12-15 08:45:31.303836031 -0500
+@@ -456,7 +456,7 @@
+ 	  break;
+ 	}
+ 
+-      if (key == '\b')
++      if (key == '\b' && cur_len)
+ 	{
+ 	  cur_len--;
+ 	  continue;
+Index: grub2-2.02~beta2/grub-core/normal/auth.c
+===================================================================
+--- grub2-2.02~beta2.orig/grub-core/normal/auth.c	2015-12-15 08:45:31.307836075 -0500
++++ grub2-2.02~beta2/grub-core/normal/auth.c	2015-12-15 08:45:31.303836031 -0500
+@@ -172,7 +172,7 @@
+ 	  break;
+ 	}
+ 
+-      if (key == '\b')
++      if (key == '\b' && cur_len)
+ 	{
+ 	  cur_len--;
+ 	  grub_printf ("\b");
diff -Nru grub2-2.02~beta2/debian/patches/series grub2-2.02~beta2/debian/patches/series
--- grub2-2.02~beta2/debian/patches/series	2015-11-25 20:15:36.000000000 +0000
+++ grub2-2.02~beta2/debian/patches/series	2015-12-15 14:11:20.000000000 +0000
@@ -60,3 +60,4 @@
 arm64-setjmp-Add-missing-license-macro.patch
 ofdisk_add_sas_disks.patch
 efinet-open-Simple-Network-Protocol-exclusively.patch
+CVE-2015-8370.patch