bluetoothdPoC

@RaniXCH bluetoothdPoC CVE-2018-4087 PoC ¿Cuál es la ETA, hijo? ¿Es un jailbreak? Depende, ¿tienes alguna vulnerabilidad de kernel? Siéntete libre de encadenarlas. Esta te permite tener una gran superficie de ataque desde dentro del sandbox...

toothpicker

ToothPicker ToothPicker 是一个进程内、覆盖引导的 iOS 模糊测试工具。它专门针对 iOS 的蓝牙守护进程 bluetoothd 开发，并用于分析 iOS 上的各种蓝牙协议。由于它基于 FRIDA 构建，因此可以调整以适配任何运行 FRIDA 的平台。 该仓库还包含一个空中模糊测试器，并给出了一个使用 InternalBlue 对 Apple 的 MagicPairing 协议进行模糊测试的实现示例。此外，还包含了 ReplayCrashFile.py 脚本，可用于验证进程内模糊测试器发现的崩溃。 新增：原地模糊测试器（ToothFlipper）...

POC-CVE-2018-4327-and-CVE-2018-4330

brokentooth POC para CVE-2018-4327 al menos eso creo, ya que tanto CVE-2018-4327 como CVE-2018-4330 fueron descritos por @SparkZheng, pero no dice cuál corresponde a cada error; como él describió este primero, supongo que es este. Probado en iPhone 6S 11.3.1 Debería funcionar hasta 11.4 Te permit...

toothfairy

toothfairy Relacionado con brokentooth enlace abajo. A diferencia de brokentooth, toothfairy no requiere presionar botones en el menú de bluetooth. Ambos CVE fueron revelados por @SparkZheng pero sin PoC, así que decidí hacer un PoC para fines de aprendizaje. El código no es perfecto pero cumple ...

UnjailMe

UnjailMe Un escape de sandbox basado en: la prueba de concepto CVE-2018-4087 de Rani Idan Zimperium la prueba de concepto de desbordamiento de securityd de @cheesecakeufo zeroday, sin CVE conocido, ¡gracias Abraham! Acerca del PoC de ZIMPERIUM Rani usó sbtool de Jonathan Levine para descubrir qué...

brokentooth

brokentooth POC para CVE-2018-4327 al menos eso creo, ya que @SparkZheng discutió tanto CVE-2018-4327 como CVE-2018-4330, pero no queda claro por su parte cuál se relaciona con cada bug; pero como describió este primero, me lanzo a adivinar. Probado en iPhone 6S 11.3.1 Debería funcionar hasta 11....

OESA-2026-3881 bluez security update

This package provides all utilities for use in Bluetooth applications. The BLUETOOTH trademarks are owned by Bluetooth SIG, Inc., U.S.A. Security Fixes: BlueZ A2DP Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute...

OESA-2026-3732 bluez security update

This package provides all utilities for use in Bluetooth applications. The BLUETOOTH trademarks are owned by Bluetooth SIG, Inc., U.S.A. Security Fixes: A vulnerability, which was classified as very critical, was found in Linux BlueZ version now known.CWE is classifying the issue as CWE-121. A...

OESA-2026-3731 bluez security update

This package provides all utilities for use in Bluetooth applications. The BLUETOOTH trademarks are owned by Bluetooth SIG, Inc., U.S.A. Security Fixes: A vulnerability, which was classified as very critical, was found in Linux BlueZ version now known.CWE is classifying the issue as CWE-121. A...

OESA-2026-3729 bluez security update

This package provides all utilities for use in Bluetooth applications. The BLUETOOTH trademarks are owned by Bluetooth SIG, Inc., U.S.A. Security Fixes: A vulnerability, which was classified as very critical, was found in Linux BlueZ version now known.CWE is classifying the issue as CWE-121. A...

[SECURITY] Fedora 44 Update: bluez-5.87+1.git8750129efca8-1.fc44

Utilities for use in Bluetooth applications: - avinfo - bluemoon - bluetoothctl - bluetoothd - btattach - btmon - hex2hcd - mpris-proxy The BLUETOOTH trademarks are owned by Bluetooth SIG, Inc., U.S.A...

CVE-2026-85218

A double stack-based buffer overflow was found in the BlueZ AVRCP controller implementation. A nearby BR/EDR peripheral can send a crafted AVRCP player-settings response that supplies an attacker-controlled attribute count, causing avrcplistplayerattributesrsp and avrcpgetcurrentplayervalue in...

[SECURITY] Fedora 43 Update: bluez-5.87-6.fc43

Utilities for use in Bluetooth applications: - avinfo - bluemoon - bluetoothctl - bluetoothd - btattach - btmon - hex2hcd - mpris-proxy The BLUETOOTH trademarks are owned by Bluetooth SIG, Inc., U.S.A...

Fedora 43 : bluez (2026-d4eec45564)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-d4eec45564 advisory. BlueZ sdp-xml.c type confusion via RegisterProfileServiceRecord can crash bluetoothd local DoS: a crafted nested ServiceRecord can corrupt the SDP X...

OESA-2026-3528 bluez security update

This package provides all utilities for use in Bluetooth applications. The BLUETOOTH trademarks are owned by Bluetooth SIG, Inc., U.S.A. Security Fixes: A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control...

SUSE CVE-2026-80185

BlueZ sdp-xml.c type confusion via RegisterProfileServiceRecord can crash bluetoothd local DoS: a crafted nested ServiceRecord can corrupt the SDP XML parser stack so scalar union data is treated as a sequence pointer, allowing a local caller to crash bluetoothd...

Fedora 44 : bluez (2026-1fba3f22c9)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-1fba3f22c9 advisory. BlueZ sdp-xml.c type confusion via RegisterProfileServiceRecord can crash bluetoothd local DoS: a crafted nested ServiceRecord can corrupt the SDP X...

EUVD-2026-66134

BlueZ sdp-xml.c type confusion via RegisterProfileServiceRecord can crash bluetoothd local DoS: a crafted nested ServiceRecord can corrupt the SDP XML parser stack so scalar union data is treated as a sequence pointer, allowing a local caller to crash bluetoothd...

CVE-2026-80186

A stack-based buffer overflow vulnerability exists in BlueZ, the Linux Bluetooth protocol stack. A remote user within Bluetooth radio range can send a specially crafted Extended Inquiry Response EIR packet that causes a buffer overflow when the target device performs Bluetooth discovery. This...

CVE-2026-80185

BlueZ sdp-xml.c type confusion via RegisterProfileServiceRecord can crash bluetoothd local DoS: a crafted nested ServiceRecord can corrupt the SDP XML parser stack so scalar union data is treated as a sequence pointer, allowing a local caller to crash bluetoothd...