CVE-2024-3077

An malicious BLE device can crash BLE victim device by sending malformed gatt packet

CVE-2024-6259

BT: HCI: adv_ext_report Improper discarding in adv_ext_report

CVE-2024-5931

BT: Unchecked user input in bap_broadcast_assistant

CVE-2024-6135

BT:Classic: Multiple missing buf length checks

CVE-2024-3332

A malicious BLE device can send a specific order of packet sequence to cause a DoS attack on the victim BLE device

CVE-2024-6137

BT: Classic: SDP OOB access in get_att_search_list

CVE-2024-6442

In ascs_cp_rsp_add in /subsys/bluetooth/audio/ascs.c, an unchecked tailroom could lead to a global buffer overflow.

CVE-2024-6444

No proper validation of the length of user input in olcp_ind_handler in zephyr/subsys/bluetooth/services/ots/ots_client.c.

CVE-2024-6443

In utf8_trunc in zephyr/lib/utils/utf8.c, last_byte_p can point to one byte before the string pointer if the string is empty.