POC-CVE-2018-4327-and-CVE-2018-4330

brokentooth POC لـ CVE-2018-4327 على الأقل هذا ما أعتقده، نظرًا لأن كلاً من CVE-2018-4327 وCVE-2018-4330 تمت الكتابة عنهما بواسطة @SparkZheng، لكن لا يُذكر أي منهما يتعلق بأي ثغرة، وبما أنه وصف هذا أولاً، فسأخمّن. تم اختباره على iPhone 6S 11.3.1 من المفترض أن يعمل حتى 11.4 يتيح لك تعيين قيمة PC...

brokentooth

brokentooth POC pour CVE-2018-4327 du moins je le pense puisque CVE-2018-4327 et CVE-2018-4330 ont tous deux été discutés par @SparkZheng mais il n'est pas clair de sa part lequel correspond à quel bogue, mais comme il a décrit celui-ci en premier, je fais une supposition. Testé sur iPhone 6S...

toothfairy

toothfairy Lié à brokentooth lien ci-dessous. Contrairement à brokentooth, toothfairy ne nécessite pas d'appuyer sur des boutons du menu Bluetooth. Les deux CVE ont été révélées par @SparkZheng mais sans POC, j'ai donc décidé d'en créer une pour l'expérience d'apprentissage. Le code n'est pas...

toothpicker

ToothPicker ToothPicker est un fuzzer in-process guidé par couverture pour iOS. Il a été développé pour cibler spécifiquement le démon Bluetooth d'iOS bluetoothd et pour analyser divers protocoles Bluetooth sur iOS. Construit avec FRIDA, il peut être adapté pour cibler n'importe quelle plateforme...

bluetoothdPoC

@RaniXCH bluetoothdPoC CVE-2018-4087 PoC ما هو الموعد المتوقع؟ هل هو كسر حماية؟ يعتمد الأمر؛ هل لديك أي ثغرة في النواة؟ يمكنك ربطها مع بعضها بكل ترحيب. هذا الاستغلال يتيح لك سطح هجوم ضخمًا من داخل صندوق الرمل. https://www.weibo.com/ttarticle/p/show?id=2309404271293301154324 - @SparkZheng - iOS...

UnjailMe

UnjailMe Une évasion de sandbox basée sur : le proof-of-concept CVE-2018-4087 par Rani Idan Zimperium le proof-of-concept de débordement de securityd par @cheesecakeufo zeroday, aucun CVE connu, merci Abraham ! À propos du PoC ZIMPERIUM Rani a utilisé sbtool de Jonathan Levine pour découvrir quel...

CVE-2026-75032

A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile AVRCP implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the...

CVE-2026-75032

A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile AVRCP implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the...

CVE-2026-75032

BlueZ's AVRCP implementation lacks packet length validation in parse_media_element() and parse_media_folder(), causing out-of-bounds reads that crash bluetoothd (DoS) and may leak heap memory. Exploitation requires user pairing. Mitigation: disable AVRCP profile or restrict Bluetooth pairing to t...

EUVD-2026-60941

A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile AVRCP implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the...

CVE-2026-75032 Bluez: bluez: out-of-bounds read in avrcp parse_media_element and parse_media_folder

A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile AVRCP implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the...

CVE-2026-75032

A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile AVRCP implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the...

CVE-2026-75032

A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile AVRCP implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the...

PT-2026-77138

A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile AVRCP implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the parse...

Linux Distros Unpatched Vulnerability : CVE-2026-75032

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile AVRCP...

EUVD-2019-18310

Malware in sbrugna...

[SECURITY] Fedora 38 Update: bluez-5.70-5.fc38

Utilities for use in Bluetooth applications: - avinfo - bluemoon - bluetoothctl - bluetoothd - btattach - btmon - hex2hcd - l2ping - l2test - mpris-proxy - rctest The BLUETOOTH trademarks are owned by Bluetooth SIG, Inc., U.S.A...

Medium: bluez

Issue Overview: An issue was discovered in bluetoothd in BlueZ through 5.48. The vulnerability lies in the handling of a SVCATTRREQ by the SDP implementation. By crafting a malicious CSTATE, it is possible to trick the server into returning more bytes than the buffer actually holds, resulting in...

Huawei EulerOS: Security Advisory for bluez (EulerOS-SA-2023-1090)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE SLED15: bluez / bluez-auto-enable-devices / bluez-cups / bluez-deprecated / etc (SUSE-SU-2022:3981-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3981-1 advisory. - CVE-2021-43400: Fixed use-after-free in gatt-database.c bsc1192394. - CVE-2021-3658: Fixed...