CVE-2023-51594 BlueZ OBEX Library Out-Of-Bounds Read Information Disclosure Vulnerability

🗓️ 03 May 2024 02:15:23Reported by zdiType

BlueZ OBEX Library Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious Bluetooth device. The specific flaw exists within the handling of OBEX protocol parameters. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer

Reporter	Title	Published	Views	Family All 49
IBM Security Bulletins	Security Bulletin: Vulnerability in BlueZ affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component.	13 Mar 202517:32	–	ibm
ATTACKERKB	CVE-2023-51594	3 May 202403:16	–	attackerkb
AlpineLinux	CVE-2023-51594	3 May 202403:16	–	alpinelinux
AlmaLinux	Moderate: bluez security update	12 Nov 202400:00	–	almalinux
BDU FSTEC	The vulnerability in the implementation of the OBEX protocol for Bluetooth on the Linux BlueZ operating system allows a hacker to cause a service failure.	22 Dec 202500:00	–	bdu_fstec
CNNVD	BlueZ 安全漏洞	3 May 202400:00	–	cnnvd
CVE	CVE-2023-51594	3 May 202402:15	–	cve
Debian CVE	CVE-2023-51594	3 May 202402:15	–	debiancve
Oracle linux	bluez security update	14 Nov 202400:00	–	oraclelinux
EUVD	EUVD-2023-56306	3 Oct 202520:07	–	euvd

[
  {
    "vendor": "BlueZ",
    "product": "BlueZ",
    "versions": [
      {
        "version": "5.66",
        "status": "affected"
      }
    ],
    "defaultStatus": "unknown"
  }
]

Source	Link
zerodayinitiative	www.zerodayinitiative.com/advisories/ZDI-23-1901/

03 May 2024 02:15Current

3.4Low risk

Vulners AI Score3.4

CVSS 32.6

EPSS0.00949

CWE-125