Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 43

Export CSV
CVE-2023-51592

BlueZ Audio Profile AVRCP parse_media_folder Out-Of-Bounds Read Information Disclosure Vulnerability

BlueZ Audio Profile AVRCP parse_media_folder Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious device. The specific flaw exists within the handling of the AVRCP protocol. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-20854.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Bluez Redhat
Products
Bluez Enterprise Linux
CVE-2023-51594

BlueZ OBEX Library Out-Of-Bounds Read Information Disclosure Vulnerability

BlueZ OBEX Library Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious Bluetooth device. The specific flaw exists within the handling of OBEX protocol parameters. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-20937.

CVSS 3.1 · 5.7 Medium EPSS 1.1% KEV · Not listed
Vendors
Bluez Redhat
Products
Bluez Enterprise Linux
CVE-2023-51596

BlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution Vulnerability

BlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious Bluetooth device. The specific flaw exists within the handling of the Phone Book Access profile. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-20939.

CVSS 3.1 · 7.1 High EPSS 1.5% KEV · Not listed
Vendors
Bluez Redhat
Products
Bluez Enterprise Linux
CVE-2023-44431

BlueZ Audio Profile AVRCP Stack-based Buffer Overflow Remote Code Execution Vulnerability

BlueZ Audio Profile AVRCP Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious device. The specific flaw exists within the handling of the AVRCP protocol. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-19909.

CVSS 3.1 · 8.0 High EPSS 1.6% KEV · Not listed
Vendors
Bluez Redhat
Products
Bluez Enterprise Linux
CVE-2017-1000250

bluez: Out-of-bounds heap read in service_search_attr_req function

All versions of the SDP server in BlueZ 5.46 and earlier are vulnerable to an information disclosure vulnerability which allows remote attackers to obtain sensitive information from the bluetoothd process memory. This vulnerability lies in the processing of SDP search attribute requests.

CVSS 3.0 · 6.5 Medium EPSS 7.8% KEV · Not listed
Vendors
Bluez Redhat
Products
Bluez Enterprise Linux
CVE-2016-7837

bluez: Buffer overflow in parse_line function

Buffer overflow in BlueZ 5.41 and earlier allows an attacker to execute arbitrary code via the parse_line function used in some userland utilities.

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Bluez
Products
Bluez
CVE-2022-3563

Linux Kernel BlueZ mgmt-tester.c read_50_controller_cap_complete null pointer dereference

A vulnerability classified as problematic has been found in Linux Kernel. Affected is the function read_50_controller_cap_complete of the file tools/mgmt-tester.c of the component BlueZ. The manipulation of the argument cap_len leads to null pointer dereference. It is recommended to apply a patch to fix this issue. VDB-211086 is the identifier assigned to this vulnerability.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Bluez
Products
Bluez
CVE-2022-3637

Linux Kernel BlueZ jlink.c jlink_init denial of service

A vulnerability has been found in Linux Kernel and classified as problematic. This vulnerability affects the function jlink_init of the file monitor/jlink.c of the component BlueZ. The manipulation leads to denial of service. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211936.

CVSS 3.1 · 2.6 Low EPSS < 1% KEV · Not listed
Vendors
Bluez
Products
Bluez
CVE-2016-9804

bluez: buffer overflow in commands_dump()

In BlueZ 5.42, a buffer overflow was observed in "commands_dump" function in "tools/parser/csr.c" source file. The issue exists because "commands" array is overflowed by supplied parameter due to lack of boundary checks on size of the buffer from frame "frm->ptr" parameter. This issue can be triggered by processing a corrupted dump file and will result in hcidump crash.

CVSS 3.0 · 5.3 Medium EPSS 2.5% KEV · Not listed
Vendors
Bluez
Products
Bluez
CVE-2016-9917

bluez: Heap-based buffer overflow vulnerability in read_n()

In BlueZ 5.42, a buffer overflow was observed in "read_n" function in "tools/hcidump.c" source file. This issue can be triggered by processing a corrupted dump file and will result in hcidump crash.

CVSS 3.1 · 7.5 High EPSS 3.6% KEV · Not listed
Vendors
Bluez
Products
Bluez
CVE-2016-9803

bluez: out-of-bounds read in le_meta_ev_dump()

In BlueZ 5.42, an out-of-bounds read was observed in "le_meta_ev_dump" function in "tools/parser/hci.c" source file. This issue exists because 'subevent' (which is used to read correct element from 'ev_le_meta_str' array) is overflowed.

CVSS 3.0 · 5.3 Medium EPSS 2.7% KEV · Not listed
Vendors
Bluez
Products
Bluez
CVE-2016-9802

bluez: buffer over-read in l2cap_packet()

In BlueZ 5.42, a buffer over-read was identified in "l2cap_packet" function in "monitor/packet.c" source file. This issue can be triggered by processing a corrupted dump file and will result in btmon crash.

CVSS 3.0 · 5.3 Medium EPSS 3.6% KEV · Not listed
Vendors
Bluez
Products
Bluez
CVE-2016-9801

bluez: buffer overflow in set_ext_ctrl()

In BlueZ 5.42, a buffer overflow was observed in "set_ext_ctrl" function in "tools/parser/l2cap.c" source file when processing corrupted dump file.

CVSS 3.0 · 5.3 Medium EPSS 3.0% KEV · Not listed
Vendors
Bluez
Products
Bluez
CVE-2016-9800

bluez: buffer overflow in pin_code_reply_dump()

In BlueZ 5.42, a buffer overflow was observed in "pin_code_reply_dump" function in "tools/parser/hci.c" source file. The issue exists because "pin" array is overflowed by supplied parameter due to lack of boundary checks on size of the buffer from frame "pin_code_reply_cp *cp" parameter.

CVSS 3.0 · 5.3 Medium EPSS 2.9% KEV · Not listed
Vendors
Bluez
Products
Bluez
CVE-2016-9799

bluez: buffer overflow in pklg_read_hci()

In BlueZ 5.42, a buffer overflow was observed in "pklg_read_hci" function in "btsnoop.c" source file. This issue can be triggered by processing a corrupted dump file and will result in btmon crash.

CVSS 3.0 · 5.3 Medium EPSS 2.0% KEV · Not listed
Vendors
Bluez
Products
Bluez
CVE-2016-9798

bluez: use-after-free in conf_opt()

In BlueZ 5.42, a use-after-free was identified in "conf_opt" function in "tools/parser/l2cap.c" source file. This issue can be triggered by processing a corrupted dump file and will result in hcidump crash.

CVSS 3.0 · 5.3 Medium EPSS 3.9% KEV · Not listed
Vendors
Bluez
Products
Bluez
CVE-2016-9797

bluez: buffer over-read in l2cap_dump()

In BlueZ 5.42, a buffer over-read was observed in "l2cap_dump" function in "tools/parser/l2cap.c" source file. This issue can be triggered by processing a corrupted dump file and will result in hcidump crash.

CVSS 3.0 · 5.3 Medium EPSS 3.7% KEV · Not listed
Vendors
Bluez
Products
Bluez
CVE-2021-3588

memory contents disclosure in cli_feat_read_cb

The cli_feat_read_cb() function in src/gatt-database.c does not perform bounds checks on the 'offset' variable before using it as an index into an array for reading.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Bluez
Products
Bluez
CVE-2021-0129

kernel: Improper access control in BlueZ may allow information disclosure vulnerability.

Improper access control in BlueZ may allow an authenticated user to potentially enable information disclosure via adjacent access.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Bluez Debian Linux and 1 more
Products
Bluez Debian Linux Linux Kernel and 1 more
CVE-2020-24490

kernel: net: bluetooth: heap buffer overflow when processing extended advertising report events

Improper buffer restrictions in BlueZ may allow an unauthenticated user to potentially enable denial of service via adjacent access. This affects all Linux kernel versions that support BlueZ.

CVSS 3.1 · 6.5 Medium EPSS 2.2% KEV · Not listed
Vendors
Bluez Linux Redhat
Products
Bluez Linux Kernel Enterprise Linux