CVE-2018-9475

In HeadsetInterface::ClccResponse of btifhf.cc, there is a possible out of bounds stack write due to a missing bounds check. This could lead to remote escalation of privilege via Bluetooth, if the recipient has enabled SIP calls with no additional execution privileges needed. User interaction is...

PT-2024-10719 · Google · Android

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue is related to a possible out of bounds read in the l2cble process sig cmd function of l2c ble.cc due to a missing bounds check. This could lea...

PT-2024-10714 · Bluetooth · Bluetooth

Name of the Vulnerable Software and Affected Versions: Bluetooth service affected versions not specified Description: The issue is related to a possible out-of-bounds read due to improper input validation in the bta hd get report act function of bta hd act.cc. This could lead to remote informatio...

PT-2024-10715 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions prior to 8.0 Description: The issue is related to a possible out-of-bounds read due to an integer overflow in the bta hd set report act function of bta hd act.cc. This could lead to remote information disclosure in the...

PT-2024-10720 · Hidh · Hidh

Name of the Vulnerable Software and Affected Versions: hidh versions affected versions not specified Description: The issue is related to a possible out of bounds read in the hidh l2cif data ind function of hidh conn.cc due to a missing bounds check. This could lead to local information disclosur...

PT-2024-10717 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions prior to 8.0 Description: The issue is related to a possible out of bounds read due to a use after free in the bta dm remove sec dev entry function of bta dm act.cc. This could lead to remote information disclosure over...

PT-2024-10716 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions prior to the fixed version Description: The issue is related to a possible out of bounds read due to an integer overflow in the intr data copy cb function of btif hd.cc. This could lead to local information disclosure in the...

USN-7089-7 linux-lowlatency, linux-lowlatency-hwe-6.8 vulnerabilities

Chenyuan Yang discovered that the USB Gadget subsystem in the Linux kernel did not properly check for the device to be enabled before writing. A local attacker could possibly use this to cause a denial of service. CVE-2024-25741 Several security issues were discovered in the Linux kernel. An...

CVE-2018-9432

In createPhonebookDialogView and createMapDialogView of BluetoothPermissionActivity.java, there is a possible permissions bypass. This could lead to local escalation of privilege due to hiding and bypassing the user's ability to disable access to contacts, with no additional execution privileges...

CVE-2018-9365

In smpdatareceived of smpl2c.cc, there is a possible out of bounds read followed by code execution due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation...

CLSA-2024-1731933167 kernel: Fix of 36 CVEs

smb: client: fix use-after-free in smb2queryinfocompound CVE-2023-52751 - smb: client: prevent new fids from being removed by laundromat CVE-2023-52751 - cifs: fix dentry lookups in directory handle cache CVE-2023-52751 - uprobe: avoid out-of-bounds memory access of fetching args CVE-2024-50067 -...

The vulnerability of the hci_acldata_packet() function in the Linux operating system allows a perpetrator to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the hciacldatapacket function in the net/bluetooth/hcicore.c module of the Linux kernel is related to the repeated use of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the...

CVE-2024-51141

An issue in TOTOLINK Bluetooth Wireless Adapter A600UB allows a local attacker to execute arbitrary code via the WifiAutoInstallDriver.exe and MSASN1.dll components...

CVE-2024-51141

An issue in TOTOLINK Bluetooth Wireless Adapter A600UB allows a local attacker to execute arbitrary code via the WifiAutoInstallDriver.exe and MSASN1.dll components...

CVE-2024-51141

An issue in TOTOLINK Bluetooth Wireless Adapter A600UB allows a local attacker to execute arbitrary code via the WifiAutoInstallDriver.exe and MSASN1.dll components...

CVE-2024-51141

CVE-2024-51141 affects TOTOLINK Bluetooth Wireless Adapter A600UB. The issue is tied to WifiAutoInstallDriver.exe and MSASN1.dll, with root cause described as incorrect integrity value checking in MSASN1.dll within the WifiAutoInstallDriver.exe file, enabling a local attacker to execute arbitrary...

Fedora 41 : linux-firmware (2024-3cd42e9e29)

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-3cd42e9e29 advisory. Update to upstream 20240909: i915: Update MTL DMC v2.23 cirrus: cs35l56: Add firmware for Cirrus CS35L54 for some HP laptops amdgpu: Revert sienna cichlid...

PT-2025-3304

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A vulnerability in the Linux kernel has been resolved. The issue is related to the Bluetooth USB disconnection, where MediaTek claims a special USB intr interface for ISO data...

PT-2024-36898

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A vulnerability in the Linux kernel has been resolved. The issue is related to the Bluetooth component, specifically in the hci conn module. The fix involves using disable delayed work...

DEBIAN-CVE-2024-24984

Improper input validation for some IntelR Wireless BluetoothR products for Windows before version 23.40 may allow an unauthenticated user to potentially enable denial of service via adjacent access...