OS X 10.10 Bluetooth BluetoothHCIChangeLocalName - Crash PoC

Exploit for macOS platform in category dos / poc / crash-issue2.c: Written for Mac OS X Yosemite 10.10 by @rpaleari and @joystick. Triggers a panic overwriting a stackcanary. gcc -Wall -o crash-issue2,.c -framework IOKit / include include include include include include struct BluetoothCall uint6...

CVE-2014-4354

Apple iOS before 8 enables Bluetooth during all upgrade actions, which makes it easier for remote attackers to bypass intended access restrictions via a Bluetooth session...

Linux Kernel 2.4.x/2.6.x Bluetooth Signed Buffer Index Vulnerability (1)

No description provided by source. source: http://www.securityfocus.com/bid/12911/info A local signed-buffer-index vulnerability affects the Linux kernel because it fails to securely handle signed values when validating memory indexes. A local attacker may leverage this issue to gain escalated...

BlueMe Bluetooth v5.0 iOS - Code Execution Vulnerability

Document Title: =============== BlueMe Bluetooth v5.0 iOS - Code Execution Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1251 Release Date: ============= 2014-04-07 Vulnerability Laboratory ID VL-ID: ====================================...

Kernel: Bluetooth: HCI & L2CAP information leaks

The Bluetooth protocol stack in the Linux kernel before 3.6 does not properly initialize certain structures, which allows local users to obtain sensitive information from kernel stack memory via a crafted application that targets the 1 L2CAP or 2 HCI implementation...

CVE-2012-6545

The Bluetooth RFCOMM implementation in the Linux kernel before 3.6 does not properly initialize certain structures, which allows local users to obtain sensitive information from kernel memory via a crafted application...

DEBIAN-CVE-2012-6544

The Bluetooth protocol stack in the Linux kernel before 3.6 does not properly initialize certain structures, which allows local users to obtain sensitive information from kernel stack memory via a crafted application that targets the 1 L2CAP or 2 HCI implementation...

CVE-2013-0349

The hidpsetuphid function in net/bluetooth/hidp/core.c in the Linux kernel before 3.7.6 does not properly copy a certain name field, which allows local users to obtain sensitive information from kernel memory by setting a long name and making an HIDPCONNADD ioctl call...

CVE-2012-6459

ConnMan 1.3 on Tizen continues to list the bluetooth service after offline mode has been enabled, which might allow remote attackers to obtain sensitive information via Bluetooth packets...

Ubuntu: Security Advisory (USN-1652-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

UBUNTU-CVE-2011-2492

The bluetooth subsystem in the Linux kernel before 3.0-rc4 does not properly initialize certain data structures, which allows local users to obtain potentially sensitive information from kernel memory via a crafted getsockopt system call, related to 1 the l2capsockgetsockoptold function in...

kernel: bluetooth: l2cap and rfcomm: fix 1 byte infoleak to userspace

The bluetooth subsystem in the Linux kernel before 3.0-rc4 does not properly initialize certain data structures, which allows local users to obtain potentially sensitive information from kernel memory via a crafted getsockopt system call, related to 1 the l2capsockgetsockoptold function in...

Microsoft Vulnerability in Bluetooth Stack Could Allow Remote Code Execution

Microsoft Vulnerability in Bluetooth Stack Could Allow Remote Code Execution The single Critical vulnerability in today's batch of security updates addresses an issue in the Bluetooth stack. Your workstations' risk to this vulnerability varies, depending on a number of factors. I'd like to use th...

CVE-2008-4681

Unspecified vulnerability in the Bluetooth RFCOMM dissector in Wireshark 0.99.7 through 1.0.3 allows remote attackers to cause a denial of service application crash or abort via unknown packets...

DEBIAN-CVE-2007-6120

The Bluetooth SDP dissector Wireshark formerly Ethereal 0.99.2 to 0.99.6 allows remote attackers to cause a denial of service infinite loop via unknown vectors...

CVE-2007-3753

Apple iPhone 1.1.1, with Bluetooth enabled, allows physically proximate attackers to cause a denial of service application termination and execute arbitrary code via crafted Service Discovery Protocol SDP packets, related to insufficient input validation...

Bluetooth setsockopt() information leaks

The setsockopt function in the L2CAP and HCI Bluetooth support in the Linux kernel before 2.4.34.3 allows context-dependent attackers to read kernel memory and obtain sensitive information via unspecified vectors involving the copyfromuser function accessing an uninitialized stack buffer...

Bluetooth setsockopt() information leaks

The setsockopt function in the L2CAP and HCI Bluetooth support in the Linux kernel before 2.4.34.3 allows context-dependent attackers to read kernel memory and obtain sensitive information via unspecified vectors involving the copyfromuser function accessing an uninitialized stack buffer...

CVE-2006-6897

Technical details for CVE-2006-6897 are not publicly provided in the connected documents you supplied. Monitor for updates.

Linux Kernel 2.4.30/2.6.11.5 - BlueTooth 'bluez_sock_create' Local Privilege Escalation

/ EDB Note: Update can be found here https://www.exploit-db.com/exploits/25290/ source: https://www.securityfocus.com/bid/12911/info A local signed-buffer-index vulnerability affects the Linux kernel because it fails to securely handle signed values when validating memory indexes. A local attacke...