20015 matches found
CVE-2023-35657
In btaavconfigind of btaavaact.cc, there is a possible out of bounds read due to type confusion. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...
Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()'
...
Bluetooth: eir: Fix possible crashes on eir_create_adv_data
...
CVE-2025-41690
A low-privileged attacker in bluetooth range may be able to access the password of a higher-privilege user Maintenance by viewing the device’s event log. This vulnerability could allow the Operator to authenticate as the Maintenance user, thereby gaining unauthorized access to sensitive...
Bluetooth: hci_core: Fix use-after-free in vhci_flush()
...
Bluetooth: btusb: mediatek: add intf release flow when usb disconnect
...
Bluetooth: af_bluetooth: Fix deadlock
...
kernel: Bluetooth: hci_core: Fix use-after-free in vhci_flush()
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicore: Fix use-after-free in vhciflush syzbot reported use-after-free in vhciflush without repro. 0 From the splat, a thread closed a vhci file descriptor while its device was being used by iotcl on another thread...
kernel: Bluetooth: hci_core: Fix use-after-free in vhci_flush()
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicore: Fix use-after-free in vhciflush syzbot reported use-after-free in vhciflush without repro. 0 From the splat, a thread closed a vhci file descriptor while its device was being used by iotcl on another thread...
Bluetooth: Disable SCO support if READ_VOICE_SETTING is unsupported/broken
...
RHEL 9 : kernel (RHSA-2025:15227)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:15227 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: mm/hugetlb: fix hugepmdunshar...
PT-2025-36040
Name of the Vulnerable Software and Affected Versions: LocalBluetoothLeBroadcast.java affected versions not specified Description: An issue exists in the generateRandomPassword function of LocalBluetoothLeBroadcast.java that may allow interception of the Auracast audio stream due to an insecure...
PT-2025-36023
Name of the Vulnerable Software and Affected Versions: BluetoothOppSendFileInfo.java affected versions not specified Description: A logic error exists in the isContentUriForOtherUser function within BluetoothOppSendFileInfo.java, potentially leading to a cross-user data leak. This issue could...
Bluetooth: hci_conn: Use disable_delayed_work_sync
...
Bluetooth: msft: fix slab-use-after-free in msft_do_close()
...
Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect()
...
CVE-2024-49728
In generateFileInfo of BluetoothOppSendFileInfo.java, there is a possible cross user media disclosure due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2024-49728
In generateFileInfo of BluetoothOppSendFileInfo.java, there is a possible cross user media disclosure due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2024-49728
In generateFileInfo of BluetoothOppSendFileInfo.java, there is a possible cross user media disclosure due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2024-49728
CVE-2024-49728 affects Android Bluetooth code via generateFileInfo in BluetoothOppSendFileInfo.java, enabling a confused deputy to cause cross-user media disclosure. The issue yields local information disclosure without additional privileges and does not require user interaction to exploit, per t...