PT-2021-13349

Name of the Vulnerable Software and Affected Versions Android versions Android-12 Description The issue is related to a missing bounds check in the gatt process notification function of gatt cl.cc, which could lead to a possible out of bounds write. This might result in remote code execution over...

OESA-2021-1254 bluez security update

This package provides all utilities for use in Bluetooth applications. The BLUETOOTH trademarks are owned by Bluetooth SIG, Inc., U.S.A. Security Fixes: The clifeatreadcb function in src/gatt-database.c does not perform bounds checks on the 'offset' variable before using it as an index into an...

BlueZ buffer overflow vulnerability (CNVD-2021-44978)

BlueZ is a Bluetooth protocol stack written in C. It is primarily used to provide support for the core Bluetooth layers and protocols. BlueZ suffers from a buffer overflow vulnerability that stems from the clifeatreadcb function in src/gatt-database.c failing to perform a bounds check on the...

CVE-2021-3588

The clifeatreadcb function in src/gatt-database.c does not perform bounds checks on the 'offset' variable before using it as an index into an array for reading...

DEBIAN-CVE-2021-3588

The clifeatreadcb function in src/gatt-database.c does not perform bounds checks on the 'offset' variable before using it as an index into an array for reading...

AZL-7183 CVE-2021-3588 affecting package bluez for versions less than 5.63-1

The clifeatreadcb function in src/gatt-database.c does not perform bounds checks on the 'offset' variable before using it as an index into an array for reading...

UBUNTU-CVE-2021-3588

The clifeatreadcb function in src/gatt-database.c does not perform bounds checks on the 'offset' variable before using it as an index into an array for reading...

CVE-2021-3588

CVE-2021-3588 affects BlueZ (BlueZ Bluetooth stack). The issue is in cli_feat_read_cb() in src/gatt-database.c where bounds checks on offset are missing before indexing an array, potentially exposing memory contents. Multiple advisories indicate downstream risk and mitigation via upgrading BlueZ ...

CVE-2021-3588

The clifeatreadcb function in src/gatt-database.c does not perform bounds checks on the 'offset' variable before using it as an index into an array for reading...

CVE-2021-3588: Access of Memory Location After End of Buffer

The clifeatreadcb function in src/gatt-database.c does not perform bounds checks on the 'offset' variable before using it as an index into an array for reading...

PT-2021-4915

Name of the Vulnerable Software and Affected Versions BlueZ affected versions not specified Description The issue is related to the cli feat read cb function in the src/gatt-database.c file of the Bluetooth protocol stack for Linux. It does not perform bounds checks on the offset variable before...

CVE-2021-3588

The clifeatreadcb function in src/gatt-database.c does not perform bounds checks on the 'offset' variable before using it as an index into an array for reading...

BlueZ 缓冲区错误漏洞

BlueZ is a Bluetooth protocol stack written in C. It is primarily used to provide support for the core Bluetooth layers and protocols. BlueZ suffers from a buffer overflow vulnerability that stems from the clifeatreadcb function in src/gatt-database.c failing to perform a bounds check on the...

PT-2021-7316 · Linux +5 · Bluez +5

Name of the Vulnerable Software and Affected Versions: bluez versions prior to 5.63 Description: A heap overflow vulnerability was found in the implementation of the GATT protocol stack for Linux BlueZ. This issue is related to a buffer overflow. An attacker with local network access could pass...

PT-2021-7064

Name of the Vulnerable Software and Affected Versions BlueZ version 5.61 Description A use-after-free issue can occur in the gatt-database.c file when a client disconnects during D-Bus processing of a WriteValue call, potentially allowing a remote attacker to access confidential information...

bluez: double free in gatttool client disconnect callback handler in src/shared/att.c could lead to DoS or RCE

In BlueZ before 5.55, a double free was found in the gatttool disconnectcb routine from shared/att.c. A remote attacker could potentially cause a denial of service or code execution, during service discovery, due to a redundant disconnect MGMT event...

CVE-2021-0328

In onBatchScanReports and deliverBatchScan of GattService.java, there is a possible way to retrieve Bluetooth scan results without permissions due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is no...

GLSA-202011-01 : BlueZ: Arbitrary code execution

The remote host is affected by the vulnerability described in GLSA-202011-01 BlueZ: Arbitrary code execution It was discovered that there was a double-free vulnerability in Bluez after the service discovery which occurs after a Bluetoth Low Energy BLE connection has been established to a device...

CVE-2020-11153

u'Out of bound memory access while processing GATT data received due to lack of check of pdu data length and leads to remote code execution' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industria...

Out-of-bounds

u'Out of bound memory access while processing GATT data received due to lack of check of pdu data length and leads to remote code execution' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industria...