CVE-2018-9475

In HeadsetInterface::ClccResponse of btifhf.cc, there is a possible out of bounds stack write due to a missing bounds check. This could lead to remote escalation of privilege via Bluetooth, if the recipient has enabled SIP calls with no additional execution privileges needed. User interaction is...

CVE-2025-3885

Harman Becker MGU21 Bluetooth Improper Input Validation Denial-of-Service Vulnerability. This vulnerability allows network-adjacent attackers to create a denial-of-service condition on affected installations of Harman Becker MGU21 devices. Authentication is not required to exploit this...

CVE-2025-3885 Harman Becker MGU21 Bluetooth Improper Input Validation Denial-of-Service Vulnerability

Harman Becker MGU21 Bluetooth Improper Input Validation Denial-of-Service Vulnerability. This vulnerability allows network-adjacent attackers to create a denial-of-service condition on affected installations of Harman Becker MGU21 devices. Authentication is not required to exploit this...

CVE-2025-3885 Harman Becker MGU21 Bluetooth Improper Input Validation Denial-of-Service Vulnerability

Harman Becker MGU21 Bluetooth Improper Input Validation Denial-of-Service Vulnerability. This vulnerability allows network-adjacent attackers to create a denial-of-service condition on affected installations of Harman Becker MGU21 devices. Authentication is not required to exploit this...

Harman Becker MGU21 输入验证错误漏洞

The Harman Becker MGU21 is an infotainment system from Harman Becker. The Harman Becker MGU21 suffers from an input validation error vulnerability that stems from the Bluetooth stack not properly validating Bluetooth frames, which could result in a denial of service...

CVE-2025-37918

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: avoid NULL pointer dereference in skbdequeue A NULL pointer dereference can occur in skbdequeue when processing a QCA firmware crash dump on WCN7851 0489:e0f3. 93.672166 Bluetooth: hci0: ACL memdump size589824...

CVE-2025-37918 Bluetooth: btusb: avoid NULL pointer dereference in skb_dequeue()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: avoid NULL pointer dereference in skbdequeue A NULL pointer dereference can occur in skbdequeue when processing a QCA firmware crash dump on WCN7851 0489:e0f3. 93.672166 Bluetooth: hci0: ACL memdump size589824...

CVE-2024-58101

Samsung Galaxy Buds and Galaxy Buds 2 audio devices are Bluetooth pairable by default without user input nor a way to stop this mode. As a consequence, audio playback takeover or even microphone recording without user consent or notification is achieved. Note: This is considered a low severity...

CVE-2024-58101

Samsung Galaxy Buds and Galaxy Buds 2 audio devices are Bluetooth pairable by default without user input nor a way to stop this mode. As a consequence, audio playback takeover or even microphone recording without user consent or notification is achieved. Note: This is considered a low severity...

Alibaba Cloud Linux 3 : 0283: bluez (ALINUX3-SA-2024:0283)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2024:0283 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2023-45866: Bluetooth HID Hosts in BlueZ may...

CVE-2024-58101

Samsung Galaxy Buds and Galaxy Buds 2 audio devices are Bluetooth pairable by default without user input nor a way to stop this mode. As a consequence, audio playback takeover or even microphone recording without user consent or notification is achieved. Note: This is considered a low severity...

PT-2025-21229 · Samsung · Galaxy Buds 2 +1

Name of the Vulnerable Software and Affected Versions: Samsung Galaxy Buds and Galaxy Buds 2 affected versions not specified Description: The issue concerns Samsung Galaxy Buds and Galaxy Buds 2 audio devices being Bluetooth pairable by default without requiring user input or providing a means to...

CVE-2024-58101

CVE-2024-58101 affects Samsung Galaxy Buds and Galaxy Buds 2. The issue arises because Bluetooth pairing is enabled by default, allowing pairings without user input or an option to disable this mode. Impact described in sources includes potential audio playback takeover and microphone recording w...

kernel: Bluetooth: Ignore too large handle values in BIG

A vulnerability was found in the Linux kernel's bluetooth subsystem in the function hcilebigsyncestablishedevt where a lack of proper checks does not validate whether a received connection handle exceeds the maximum allowed value. This could lead to system instability or crashes...

CVE-2023-53145

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btsdio: fix use after free bug in btsdioremove due to race condition In btsdioprobe, the data-work is bound with btsdiowork. It will be started in btsdiosendframe. If the btsdioremove runs with a unfinished work, there...

CVE-2023-53145

In the Linux kernel, the Bluetooth driver subsystem btsdio is affected by a use-after-free race in btsdio_remove. In btsdio_probe, data->work is bound to btsdio_work and started via btsdio_send_frame. If btsdio_remove executes while the work is unfinished, hdev could be freed but still used by...

CVE-2023-53145 Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btsdio: fix use after free bug in btsdioremove due to race condition In btsdioprobe, the data-work is bound with btsdiowork. It will be started in btsdiosendframe. If the btsdioremove runs with a unfinished work, there...

SUSE CVE-2022-49910

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix use-after-free caused by l2capreassemblesdu Fix the race condition between the following two flows that run in parallel: 1. l2capreassemblesdu - chan-ops-recv l2capsockrecvcb - sockqueuercvskb. 2...

Security update for the Linux Kernel (Live Patch 5 for SLE 15 SP6)

This update for the Linux Kernel 6.4.0-1506002325 fixes several issues. The following security issues were fixed: CVE-2024-53237: Bluetooth: fix use-after-free in deviceforeachchild bsc1235008. CVE-2024-53082: virtionet: Add hashkeylength check bsc1233677. CVE-2024-8805: Bluetooth: hcievent: Alig...

PT-2025-19992

Name of the Vulnerable Software and Affected Versions: bta av aact.cc affected versions not specified Description: An out-of-bounds read due to type confusion exists in the bta av config ind function of bta av aact.cc. This could lead to local information disclosure and does not require additiona...