polypyus

Polypyus 固件史官 Polypyus 通过学习从相似固件中提取已知函数，从而学会在原始二进制文件中定位函数。因此，它是一位固件史官。 Polypyus 无需反汇编这些二进制文件即可工作，这对于难以反汇编且常用工具会遗漏函数的二进制文件来说是一个优势。此外，仅基于二进制的方法使其非常快速，只需几秒即可运行。然而，这种方法要求二进制文件具有相同的架构和相似的编译器选项。 Polypyus 可集成到现有工具（如 Ghidra 、 IDA 、 BinDiff 和 Diaphora ）的工作流程中。例如，它可以导入之前注释过的函数并从中学到知识，还可以导出已找到的函数以便导入到 IDA...

DEBIAN-CVE-2026-98110

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: bound firmware ID by TLV length The firmware ID is treated as a NUL-terminated string even though the TLV length is its only boundary. If the value does not contain a NUL terminator, snprintf can read beyond t...

CVE-2026-79378

The Bestechnic Co., Ltd BES2300 Bluetooth Audio SoC is vulnerable in its firmware v3.x and earlier due to an issue in the btm_acl_handle() function. An attacker can trigger a Denial of Service (DoS) by sending a crafted L2CAP packet . While the CVSS score indicates a High severity (7.5) with a Ne...

CVE-2026-79378

An issue in the btmaclhandle function of Bestechnic Co., Ltd BES2300 Bluetooth Audio SoC firmware v3.x and earlier allows attackers to cause a Denial of Service DoS via sending a crafted L2CAP packet...

CVE-2026-68479

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btrtl: validate firmware patch bounds rtlbtparsefirmware copies patchlength - 4 bytes before appending the firmware version. A malformed firmware patch shorter than the version field can make this subtraction underflow...

Linux Distros Unpatched Vulnerability : CVE-2026-64407

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxprecvfwreqv3 During the v3 firmware download the controller sends a v3datareq with a 32 bit offset a...

CVE-2026-43069 Bluetooth: hci_ll: Fix firmware leak on error path

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcill: Fix firmware leak on error path Smatch reports: drivers/bluetooth/hcill.c:587 downloadfirmware warn: 'fw' from requestfirmware not released on lines: 544. In downloadfirmware, if requestfirmware succeeds but the...

Linux Distros Unpatched Vulnerability : CVE-2026-43069

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: hcill: Fix firmware leak on error path Smatch reports: drivers/bluetooth/hcill.c:587 downloadfirmware warn: 'fw' from requestfirmware not released on...

PT-2026-37072

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A resource leak exists in the Bluetooth component. In the download firmware function, if request firmware succeeds but the returned firmware content is invalid, such as having no data or...

MiracleLinux 7 : linux-firmware-20200421-80.git78c0348.el7 (AXSA:2021-1366:02)

The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2021-1366:02 advisory. hardware: buffer overflow in bluetooth firmware CVE-2020-12321 Tenable has extracted the preceding description block directly from the MiracleLinux security...

MiracleLinux 8 : linux-firmware-20200619-101.git3890db36.el8 (AXSA:2021-1383:03)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2021-1383:03 advisory. hardware: buffer overflow in bluetooth firmware CVE-2020-12321 Tenable has extracted the preceding description block directly from the MiracleLinux security...

Fedora: Security Advisory (FEDORA-2026-2cebf295af)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 42 : linux-firmware (2026-1d240112ff)

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-1d240112ff advisory. Update to 20260110: update firmware for MT7925 WiFi device mediatek MT7925: update bluetooth firmware to 20260106153314 mediatek MT7920: update bluetooth...

EUVD-2025-202589

An issue in the Bluetooth firmware of JXL 9 Inch Car Android Double Din Player Android v12.0 allows attackers to cause a Denial of Service DoS via sending a crafted Link Manager Protocol LMP packet...

CVE-2025-63895

An issue in the Bluetooth firmware of JXL 9 Inch Car Android Double Din Player Android v12.0 allows attackers to cause a Denial of Service DoS via sending a crafted Link Manager Protocol LMP packet...

CVE-2025-63895

An issue in the Bluetooth firmware of JXL 9 Inch Car Android Double Din Player Android v12.0 allows attackers to cause a Denial of Service DoS via sending a crafted Link Manager Protocol LMP packet...

PT-2025-50488

Name of the Vulnerable Software and Affected Versions JXL 9 Inch Car Android Double Din Player version 12.0 Description An issue in the Bluetooth firmware allows attackers to cause a Denial of Service DoS by sending a crafted Link Manager Protocol LMP packet. A crafted LMP packet is a specific ty...

CVE-2025-63895

The JXL 9 Inch Car Android Double Din Player running Android v12.0 is vulnerable to a Denial of Service (DoS) attack due to a flaw in the Bluetooth firmware stack . Specifically, the Bluetooth Classic version 5.0 implementation fails to properly handle Link Manager Protocol (LMP) packets. An atta...

CVE-2025-63895: Improper Resource Shutdown or Release

An issue in the Bluetooth firmware of JXL 9 Inch Car Android Double Din Player Android v12.0 allows attackers to cause a Denial of Service DoS via sending a crafted Link Manager Protocol LMP packet...

CVE-2025-65824

The Meatmeet Pro BBQ Thermometer (specifically version v1.0.34.4 ) is vulnerable to an unauthorized Over The Air (OTA) firmware upgrade via Bluetooth Low Energy (BLE) . The root cause is the device's failure to perform authenticity checks on firmware updates, allowing an unauthenticated attacker ...