UBUNTU-CVE-2012-6544

The Bluetooth protocol stack in the Linux kernel before 3.6 does not properly initialize certain structures, which allows local users to obtain sensitive information from kernel stack memory via a crafted application that targets the 1 L2CAP or 2 HCI implementation...

Ubuntu: Security Advisory (USN-1648-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

kernel: bluetooth: buffer overflow in l2cap config request

Integer underflow in the l2capconfigreq function in net/bluetooth/l2capcore.c in the Linux kernel before 3.0 allows remote attackers to cause a denial of service heap memory corruption or possibly have unspecified other impact via a small command-size value within the command header of a Logical...

Windows Bluetooth栈bthport.sys驱动程序远程代码执行漏洞(MS11-053)

BUGTRAQ ID: 48617 CVE ID: CVE-2011-1265 Microsoft Windows Bluetooth stack是蓝牙协议栈的实现。 Microsoft Windows Bluetooth stack在实现上存在远程代码执行漏洞，远程攻击者可通过发送特制的蓝牙报文到受影响系统利用此漏洞导致远程代码执行。此漏洞仅影响带有蓝牙功能的系统。 漏洞源于访问未能正确初始化或处理已经被删除内存对象的方式存在的问题。 Microsoft Windows Vista SP2 Microsoft Windows Vista SP1 Microsoft Windows 7...

kernel: bnep device field missing NULL terminator

The bnepsockioctl function in net/bluetooth/bnep/sock.c in the Linux kernel before 2.6.39 does not ensure that a certain device field ends with a '\0' character, which allows local users to obtain potentially sensitive information from kernel stack memory, or cause a denial of service BUG and...

kernel: bt sco_conninfo infoleak

The scosockgetsockoptold function in net/bluetooth/sco.c in the Linux kernel before 2.6.39 does not initialize a certain structure, which allows local users to obtain potentially sensitive information from kernel stack memory via the SCOCONNINFO option...

Multiple security vulnerabilities in Bluetooth protocol and Bluetooth stacks implementations

Buffer overflows, weak authentication algorithm, weak pseudo-random number generators, directory traversals, etc...

[Full-disclosure] DMA[2005-0712a] - 'Nokia Affix Bluetooth btftp client buffer overflow'

DMA2005-0712a - 'Nokia Affix Bluetooth btftp client buffer overflow' Author: Kevin Finisterre Vendor: http://www-nrc.nokia.com/affix/, http://affix.sourceforge.net Product: 'affix' References: http://www.digitalmunition.com/DMA2005-0712a.txt Description: Affix is a Bluetooth Protocol Stack for...

CVE-2005-1294: Undefined Security Weakness

The affixsockregister in the Affix Bluetooth Protocol Stack for Linux might allow local users to gain privileges via a socket call with a negative protocol value, which is used as an array index...

Affix Bluetooth Protocol Stack 3.1/3.2 - Signed Buffer Index (1)

// source: https://www.securityfocus.com/bid/13347/info A local signed buffer index vulnerability affects Affix Bluetooth Protocol Stack. This issue is due to a failure of the affected utility to properly handle user-supplied buffer size parameters. This issue may be leveraged by a local attacker...

Affix Bluetooth Protocol Stack 3.13.2 - Signed Buffer Index (2)

Affix Bluetooth Protocol Stack 3.13.2 - Signed Buffer Index 2 // source: https://www.securityfocus.com/bid/13347/info A local signed buffer index vulnerability affects Affix Bluetooth Protocol Stack. This issue is due to a failure of the affected utility to properly handle user-supplied buffer si...

Affix Bluetooth Protocol Stack 3.1/3.2 - Signed Buffer Index (2)

// source: https://www.securityfocus.com/bid/13347/info A local signed buffer index vulnerability affects Affix Bluetooth Protocol Stack. This issue is due to a failure of the affected utility to properly handle user-supplied buffer size parameters. This issue may be leveraged by a local attacker...

CVE-2005-1294

The affixsockregister in the Affix Bluetooth Protocol Stack for Linux might allow local users to gain privileges via a socket call with a negative protocol value, which is used as an array index...