CVE-2017-1000250

2017-09-1200:00:00

ubuntu.com

6.5 Medium

CVSS3

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

3.3 Low

CVSS2

Access Vector

ADJACENT_NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:A/AC:L/Au:N/C:P/I:N/A:N

0.005 Low

EPSS

Percentile

76.2%

JSON

All versions of the SDP server in BlueZ 5.46 and earlier are vulnerable to
an information disclosure vulnerability which allows remote attackers to
obtain sensitive information from the bluetoothd process memory. This
vulnerability lies in the processing of SDP search attribute requests.

OSVersionArchitecturePackageVersionFilename
ubuntu14.04noarchbluez< 4.101-0ubuntu13.3UNKNOWN
ubuntu16.04noarchbluez< 5.37-0ubuntu5.1UNKNOWN
ubuntu17.04noarchbluez< 5.43-0ubuntu1.1UNKNOWN