brokentooth

brokentooth POC para CVE-2018-4327 pelo menos é o que acho, já que CVE-2018-4327 e CVE-2018-4330 foram ambos discutidos por @SparkZheng, mas não está claro qual deles corresponde a qual bug; como ele descreveu este primeiro, estou fazendo uma suposição. Testado no iPhone 6S 11.3.1 Deve funcionar...

toothfairy

toothfairy ब्रोकेनटूथ से संबंधित नीचे लिंक किया गया। ब्रोकेनटूथ के विपरीत, टूथफेयरी को ब्लूटूथ मेनू पर बटन दबाने की आवश्यकता नहीं होती है। दोनों CVE @SparkZheng द्वारा उजागर किए गए थे लेकिन बिना POC के, इसलिए मैंने सीखने के अनुभव के लिए एक POC बनाने का निर्णय लिया। कोड सही नहीं है लेकिन यह काम कर...

POC-CVE-2018-4327-and-CVE-2018-4330

brokentooth CVE-2018-4327 के लिए POC कम से कम मुझे ऐसा लगता है क्योंकि CVE-2018-4327 और CVE-2018-4330 दोनों के बारे में @SparkZheng ने लिखा था, लेकिन यह नहीं बताया कि कौन सा बग किससे संबंधित है, लेकिन चूंकि उन्होंने पहले इसका वर्णन किया था, इसलिए मैं अनुमान लगा रहा हूँ। iPhone 6S 11.3.1 पर परीक्ष...

toothpicker

ToothPicker O ToothPicker é um fuzzer em processo guiado por cobertura para iOS. Foi desenvolvido para visar especificamente o daemon Bluetooth do iOS bluetoothd e para analisar vários protocolos Bluetooth no iOS. Como é construído usando FRIDA, pode ser adaptado para atingir qualquer plataforma...

bluetoothdPoC

@RaniXCH bluetoothdPoC CVE-2018-4087 PoC ما هو الموعد المتوقع؟ هل هو كسر حماية؟ يعتمد الأمر؛ هل لديك أي ثغرة في النواة؟ يمكنك ربطها مع بعضها بكل ترحيب. هذا الاستغلال يتيح لك سطح هجوم ضخمًا من داخل صندوق الرمل. https://www.weibo.com/ttarticle/p/show?id=2309404271293301154324 - @SparkZheng - iOS...

UnjailMe

UnjailMe Uma fuga de sandbox baseada em: no proof-of-concept CVE-2018-4087 por Rani Idan Zimperium no proof-of-concept de overflow do securityd por @cheesecakeufo zeroday, nenhum CVE conhecido, obrigado Abraham! Sobre o PoC da ZIMPERIUM Rani usou o sbtool de Jonathan Levine para descobrir quais...

CVE-2026-75032

A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile AVRCP implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the...

CVE-2026-75032

A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile AVRCP implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the...

CVE-2026-75032

BlueZ's AVRCP implementation lacks packet length validation in parse_media_element() and parse_media_folder(), causing out-of-bounds reads that crash bluetoothd (DoS) and may leak heap memory. Exploitation requires user pairing. Mitigation: disable AVRCP profile or restrict Bluetooth pairing to t...

EUVD-2026-60941

A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile AVRCP implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the...

CVE-2026-75032 Bluez: bluez: out-of-bounds read in avrcp parse_media_element and parse_media_folder

A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile AVRCP implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the...

CVE-2026-75032

A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile AVRCP implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the...

CVE-2026-75032

A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile AVRCP implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the...

PT-2026-77138

A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile AVRCP implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the parse...

Linux Distros Unpatched Vulnerability : CVE-2026-75032

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile AVRCP...

EUVD-2019-18310

Malware in sbrugna...

[SECURITY] Fedora 38 Update: bluez-5.70-5.fc38

Utilities for use in Bluetooth applications: - avinfo - bluemoon - bluetoothctl - bluetoothd - btattach - btmon - hex2hcd - l2ping - l2test - mpris-proxy - rctest The BLUETOOTH trademarks are owned by Bluetooth SIG, Inc., U.S.A...

Medium: bluez

Issue Overview: An issue was discovered in bluetoothd in BlueZ through 5.48. The vulnerability lies in the handling of a SVCATTRREQ by the SDP implementation. By crafting a malicious CSTATE, it is possible to trick the server into returning more bytes than the buffer actually holds, resulting in...

Huawei EulerOS: Security Advisory for bluez (EulerOS-SA-2023-1090)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE SLED15: bluez / bluez-auto-enable-devices / bluez-cups / bluez-deprecated / etc (SUSE-SU-2022:3981-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3981-1 advisory. - CVE-2021-43400: Fixed use-after-free in gatt-database.c bsc1192394. - CVE-2021-3658: Fixed...