kernel: memory leak in l2cap_recv_acldata of the file net/bluetooth/l2cap_core.c

A memory leak flaw was found in the Linux kernel’s L2CAP bluetooth functionality. This issue occurs when a user generates malicious packets, triggering the l2caprecvacldata function. This flaw allows a local or bluetooth connection user to potentially crash the system...

Windows Bluetooth Driver Elevation of Privilege Vulnerability

...

UNISOC Chipsets 安全漏洞

UNISOC Chipsets is a chipset from China's Zilight Spreadtrum UNISOC. A security vulnerability exists in the UNISOC Chipsets bluetooth service module due to a lack of privilege checking...

The vulnerability of the shared host device Bluetooth function with VMware Workstation and VMware Fusion allows a attacker to execute arbitrary code.

The vulnerability of the shared-host Bluetooth device function with VMware Workstation and VMware Fusion lies in the possibility of buffer overflow attacks based on the stack. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

CVE-2022-48313

The Bluetooth module has a vulnerability of bypassing the user confirmation in the pairing process. Successful exploitation of this vulnerability may affect confidentiality...

CVE-2022-48313

The Bluetooth module has a vulnerability of bypassing the user confirmation in the pairing process. Successful exploitation of this vulnerability may affect confidentiality...

PT-2023-9086 · Bluez +4 · Bluez +4

Name of the Vulnerable Software and Affected Versions: BlueZ affected versions not specified Description: The issue is related to a stack-based buffer overflow in the Audio Profile AVRCP component of the BlueZ Bluetooth protocol stack for Linux. This allows network-adjacent attackers to execute...

About the security content of AirPods and Beats firmware updates

About the security content of AirPods and Beats firmware updates This document describes the security content of AirPods and Beats firmware updates. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has...

Vulnerability of the hci_init_stage_sync() function (net/bluetooth/hci_sync.c) in the Linux operating system, which allows a attacker to disclose protected information

The vulnerability of the hciinitstagesync function net/bluetooth/hcisync.c in the Linux operating system is related to reading data beyond the buffer boundaries in memory. Exploiting this vulnerability could allow a remote attacker to disclose sensitive information that is protected by this...

CVE-2023-28464

hciconncleanup in net/bluetooth/hciconn.c in the Linux kernel through 6.2.9 has a use-after-free observed in hciconnhashflush because of calls to hcidevput and hciconnput. There is a double free that may lead to privilege escalation...

CVE-2023-28464

hciconncleanup in net/bluetooth/hciconn.c in the Linux kernel through 6.2.9 has a use-after-free observed in hciconnhashflush because of calls to hcidevput and hciconnput. There is a double free that may lead to privilege escalation...

UBUNTU-CVE-2023-28464

hciconncleanup in net/bluetooth/hciconn.c in the Linux kernel through 6.2.9 has a use-after-free observed in hciconnhashflush because of calls to hcidevput and hciconnput. There is a double free that may lead to privilege escalation...

CVE-2022-48355

The Bluetooth module has a heap out-of-bounds read vulnerability. Successful exploitation of this vulnerability can cause the Bluetooth process to crash...

AZL-25933 CVE-2023-28866 affecting package kernel for versions less than 5.15.122.1-2

In the Linux kernel through 6.2.8, net/bluetooth/hcisync.c allows out-of-bounds access because ampinit1 and ampinit2 are supposed to have an intentionally invalid element, but do not...

DEBIAN-CVE-2023-28866

In the Linux kernel through 6.2.8, net/bluetooth/hcisync.c allows out-of-bounds access because ampinit1 and ampinit2 are supposed to have an intentionally invalid element, but do not...

UBUNTU-CVE-2023-28866

In the Linux kernel through 6.2.8, net/bluetooth/hcisync.c allows out-of-bounds access because ampinit1 and ampinit2 are supposed to have an intentionally invalid element, but do not...

CVE-2022-48354

The Bluetooth module has a heap out-of-bounds write vulnerability. Successful exploitation of this vulnerability can cause the Bluetooth process to crash...

CVE-2022-48291

The Bluetooth module has an authentication bypass vulnerability in the pairing process. Successful exploitation of this vulnerability may affect confidentiality...

CVE-2023-20990

In btmblerandenccomplete of btmble.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID:...

CVE-2022-20467

In isBluetoothShareUri of BluetoothOppUtility.java, there is a possible incorrect file read due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11...