Bluez
by Bluez
Source repositories
CVEs (43)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2020-12352 | 0.03 | — | 0.06 | Nov 23, 2020 | Improper access control in BlueZ may allow an unauthenticated user to potentially enable information disclosure via adjacent access. | |||
| CVE-2020-12351 | 0.03 | — | 0.08 | Nov 23, 2020 | Improper input validation in BlueZ may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access. | |||
| CVE-2006-6899 | 0.03 | — | 0.03 | Dec 31, 2006 | hidd in BlueZ (bluez-utils) before 2.25 allows remote attackers to obtain control of the (1) Mouse and (2) Keyboard Human Interface Device (HID) via a certain configuration of two HID (PSM) endpoints, operating as a server, aka HidAttack. | |||
| CVE-2023-45866 | 0.01 | — | 0.08 | Dec 8, 2023 | Bluetooth HID Hosts in BlueZ may permit an unauthenticated Peripheral role HID Device to initiate and establish an encrypted connection, and accept HID keyboard reports, potentially permitting injection of HID messages when no user interaction has occurred in the Central role to… | |||
| CVE-2024-8805 | 0.00 | — | 0.02 | Nov 22, 2024 | BlueZ HID over GATT Profile Improper Access Control Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. Authentication is not required to exploit this vulnerability. The specific… | |||
| CVE-2023-51596 | 0.00 | — | 0.01 | May 3, 2024 | BlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that… | |||
| CVE-2023-51594 | 0.00 | — | 0.01 | May 3, 2024 | BlueZ OBEX Library Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target… | |||
| CVE-2023-51592 | 0.00 | — | 0.01 | May 3, 2024 | BlueZ Audio Profile AVRCP parse_media_folder Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information via Bluetooth on affected installations of BlueZ. User interaction is required to exploit… | |||
| CVE-2023-51589 | 0.00 | — | 0.01 | May 3, 2024 | BlueZ Audio Profile AVRCP parse_media_element Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information via Bluetooth on affected installations of BlueZ. User interaction is required to exploit… | |||
| CVE-2023-51580 | 0.00 | — | 0.01 | May 3, 2024 | BlueZ Audio Profile AVRCP avrcp_parse_attribute_list Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information via Bluetooth on affected installations of BlueZ. User interaction is required to… | |||
| CVE-2023-50230 | 0.00 | — | 0.01 | May 3, 2024 | BlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that… | |||
| CVE-2023-50229 | 0.00 | — | 0.02 | May 3, 2024 | BlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that… | |||
| CVE-2023-44431 | 0.00 | — | 0.02 | May 3, 2024 | BlueZ Audio Profile AVRCP Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this vulnerability… | |||
| CVE-2023-27349 | 0.00 | — | 0.01 | May 3, 2024 | BlueZ Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this… | |||
| CVE-2022-3637 | 0.00 | — | 0.00 | Oct 21, 2022 | A vulnerability has been found in Linux Kernel and classified as problematic. This vulnerability affects the function jlink_init of the file monitor/jlink.c of the component BlueZ. The manipulation leads to denial of service. It is recommended to apply a patch to fix this issue.… | |||
| CVE-2022-3563 | 0.00 | — | 0.00 | Oct 17, 2022 | A vulnerability classified as problematic has been found in Linux Kernel. Affected is the function read_50_controller_cap_complete of the file tools/mgmt-tester.c of the component BlueZ. The manipulation of the argument cap_len leads to null pointer dereference. It is… | |||
| CVE-2021-41229 | 0.00 | — | 0.01 | Nov 12, 2021 | BlueZ is a Bluetooth protocol stack for Linux. In affected versions a vulnerability exists in sdp_cstate_alloc_buf which allocates memory which will always be hung in the singly linked list of cstates and will not be freed. This will cause a memory leak over time. The data can… | |||
| CVE-2021-43400 | 0.00 | — | 0.02 | Nov 4, 2021 | An issue was discovered in gatt-database.c in BlueZ 5.61. A use-after-free can occur when a client disconnects during D-Bus processing of a WriteValue call. | |||
| CVE-2021-3588 | 0.00 | — | 0.00 | Jun 10, 2021 | The cli_feat_read_cb() function in src/gatt-database.c does not perform bounds checks on the 'offset' variable before using it as an index into an array for reading. | |||
| CVE-2021-0129 | 0.00 | — | 0.01 | Jun 9, 2021 | Improper access control in BlueZ may allow an authenticated user to potentially enable information disclosure via adjacent access. |
- CVE-2020-12352Nov 23, 2020risk 0.03cvss —epss 0.06
Improper access control in BlueZ may allow an unauthenticated user to potentially enable information disclosure via adjacent access.
- CVE-2020-12351Nov 23, 2020risk 0.03cvss —epss 0.08
Improper input validation in BlueZ may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.
- CVE-2006-6899Dec 31, 2006risk 0.03cvss —epss 0.03
hidd in BlueZ (bluez-utils) before 2.25 allows remote attackers to obtain control of the (1) Mouse and (2) Keyboard Human Interface Device (HID) via a certain configuration of two HID (PSM) endpoints, operating as a server, aka HidAttack.
- CVE-2023-45866Dec 8, 2023risk 0.01cvss —epss 0.08
Bluetooth HID Hosts in BlueZ may permit an unauthenticated Peripheral role HID Device to initiate and establish an encrypted connection, and accept HID keyboard reports, potentially permitting injection of HID messages when no user interaction has occurred in the Central role to…
- CVE-2024-8805Nov 22, 2024risk 0.00cvss —epss 0.02
BlueZ HID over GATT Profile Improper Access Control Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. Authentication is not required to exploit this vulnerability. The specific…
- CVE-2023-51596May 3, 2024risk 0.00cvss —epss 0.01
BlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that…
- CVE-2023-51594May 3, 2024risk 0.00cvss —epss 0.01
BlueZ OBEX Library Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target…
- CVE-2023-51592May 3, 2024risk 0.00cvss —epss 0.01
BlueZ Audio Profile AVRCP parse_media_folder Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information via Bluetooth on affected installations of BlueZ. User interaction is required to exploit…
- CVE-2023-51589May 3, 2024risk 0.00cvss —epss 0.01
BlueZ Audio Profile AVRCP parse_media_element Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information via Bluetooth on affected installations of BlueZ. User interaction is required to exploit…
- CVE-2023-51580May 3, 2024risk 0.00cvss —epss 0.01
BlueZ Audio Profile AVRCP avrcp_parse_attribute_list Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information via Bluetooth on affected installations of BlueZ. User interaction is required to…
- CVE-2023-50230May 3, 2024risk 0.00cvss —epss 0.01
BlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that…
- CVE-2023-50229May 3, 2024risk 0.00cvss —epss 0.02
BlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that…
- CVE-2023-44431May 3, 2024risk 0.00cvss —epss 0.02
BlueZ Audio Profile AVRCP Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this vulnerability…
- CVE-2023-27349May 3, 2024risk 0.00cvss —epss 0.01
BlueZ Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this…
- CVE-2022-3637Oct 21, 2022risk 0.00cvss —epss 0.00
A vulnerability has been found in Linux Kernel and classified as problematic. This vulnerability affects the function jlink_init of the file monitor/jlink.c of the component BlueZ. The manipulation leads to denial of service. It is recommended to apply a patch to fix this issue.…
- CVE-2022-3563Oct 17, 2022risk 0.00cvss —epss 0.00
A vulnerability classified as problematic has been found in Linux Kernel. Affected is the function read_50_controller_cap_complete of the file tools/mgmt-tester.c of the component BlueZ. The manipulation of the argument cap_len leads to null pointer dereference. It is…
- CVE-2021-41229Nov 12, 2021risk 0.00cvss —epss 0.01
BlueZ is a Bluetooth protocol stack for Linux. In affected versions a vulnerability exists in sdp_cstate_alloc_buf which allocates memory which will always be hung in the singly linked list of cstates and will not be freed. This will cause a memory leak over time. The data can…
- CVE-2021-43400Nov 4, 2021risk 0.00cvss —epss 0.02
An issue was discovered in gatt-database.c in BlueZ 5.61. A use-after-free can occur when a client disconnects during D-Bus processing of a WriteValue call.
- CVE-2021-3588Jun 10, 2021risk 0.00cvss —epss 0.00
The cli_feat_read_cb() function in src/gatt-database.c does not perform bounds checks on the 'offset' variable before using it as an index into an array for reading.
- CVE-2021-0129Jun 9, 2021risk 0.00cvss —epss 0.01
Improper access control in BlueZ may allow an authenticated user to potentially enable information disclosure via adjacent access.
Page 2 of 3