https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 19:44:29 +0000 https://cve.radiocsirt.org/vuln/alsa-2024:9413 <p><strong>Affected:</strong> AlmaLinux:9: bluez, AlmaLinux:9: bluez-cups, AlmaLinux:9: bluez-libs, AlmaLinux:9: bluez-libs-devel, AlmaLinux:9: bluez-obexd</p> <p>The bluez packages contain the following utilities for use in Bluetooth applications: hcitool, hciattach, hciconfig, bluetoothd, l2ping, start scripts (AlmaLinux), and pcmcia configuration files.</p> <p>Security Fix(es):</p> <p>* bluez: unauthorized HID device connections allows keystroke injection and arbitrary commands execution (CVE-2023-45866) * BlueZ: Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability (CVE-2023-27349) * bluez: phone book access profile heap-based buffer overflow remote code execution vulnerability (CVE-2023-51596) * bluez: OBEX library out-of-bounds read information disclosure vulnerability (CVE-2023-51594) * bluez: audio profile avrcp parse_media_folder out-of-bounds read information disclosure vulnerability (CVE-2023-51592) * bluez: audio profile avrcp parse_media_element out-of-bounds read information disclosure vulnerability (CVE-2023-51589) * bluez: avrcp_parse_attribute_list out-of-bounds read information disclosure vulnerability (CVE-2023-51580) * bluez: AVRCP stack-based buffer overflow remote code execution vulnerability (CVE-2023-44431) * bluez: phone book access profile heap-based buffer overflow remote code execution vulnerability (CVE-2023-50230) * bluez: phone book access profile heap-based buffer overflow remote code execution vulnerability (CVE-2023-50229)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information,…</p> <p><strong>Affected:</strong> AlmaLinux:9: bluez, AlmaLinux:9: bluez-cups, AlmaLinux:9: bluez-libs, AlmaLinux:9: bluez-libs-devel, AlmaLinux:9: bluez-obexd</p> <p>The bluez packages contain the following utilities for use in Bluetooth applications: hcitool, hciattach, hciconfig, bluetoothd, l2ping, start scripts (AlmaLinux), and pcmcia configuration files.</p> <p>Security Fix(es):</p> <p>* bluez: unauthorized HID device connections allows keystroke injection and arbitrary commands execution (CVE-2023-45866) * BlueZ: Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability (CVE-2023-27349) * bluez: phone book access profile heap-based buffer overflow remote code execution vulnerability (CVE-2023-51596) * bluez: OBEX library out-of-bounds read information disclosure vulnerability (CVE-2023-51594) * bluez: audio profile avrcp parse_media_folder out-of-bounds read information disclosure vulnerability (CVE-2023-51592) * bluez: audio profile avrcp parse_media_element out-of-bounds read information disclosure vulnerability (CVE-2023-51589) * bluez: avrcp_parse_attribute_list out-of-bounds read information disclosure vulnerability (CVE-2023-51580) * bluez: AVRCP stack-based buffer overflow remote code execution vulnerability (CVE-2023-44431) * bluez: phone book access profile heap-based buffer overflow remote code execution vulnerability (CVE-2023-50230) * bluez: phone book access profile heap-based buffer overflow remote code execution vulnerability (CVE-2023-50229)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information,…</p> https://cve.radiocsirt.org/vuln/alsa-2024:9413 https://cve.radiocsirt.org/vuln/bdu:2024-01454 bdu:2024-01454 https://cve.radiocsirt.org/vuln/bdu:2024-01454 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0855 certfr-2025-avi-0855 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0855 https://cve.radiocsirt.org/vuln/euvd-2026-258818 EUVD-2026-258818 https://cve.radiocsirt.org/vuln/euvd-2026-258818 https://cve.radiocsirt.org/vuln/fkie_cve-2023-27349 <p>BlueZ Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious device.</p> <p>The specific flaw exists within the handling of the AVRCP protocol. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-19908.</p> <p>BlueZ Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious device.</p> <p>The specific flaw exists within the handling of the AVRCP protocol. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-19908.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-27349 https://cve.radiocsirt.org/vuln/ghsa-r3vg-5hjq-528v <p>BlueZ Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious device.</p> <p>The specific flaw exists within the handling of the AVRCP protocol. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-19908.</p> <p>BlueZ Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious device.</p> <p>The specific flaw exists within the handling of the AVRCP protocol. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-19908.</p> https://cve.radiocsirt.org/vuln/ghsa-r3vg-5hjq-528v https://cve.radiocsirt.org/vuln/gsd-2023-27349 gsd-2023-27349 https://cve.radiocsirt.org/vuln/gsd-2023-27349 https://cve.radiocsirt.org/vuln/oesa-2023-1249 <p><strong>Affected:</strong> openEuler:20.03-LTS-SP1: bluez, openEuler:20.03-LTS-SP3: bluez, openEuler:22.03-LTS: bluez, openEuler:22.03-LTS-SP1: bluez</p> <p>This package provides all utilities for use in Bluetooth applications. The BLUETOOTH trademarks are owned by Bluetooth SIG, Inc., U.S.A. Security Fix(es): (CVE-2023-27349)</p> <p><strong>Affected:</strong> openEuler:20.03-LTS-SP1: bluez, openEuler:20.03-LTS-SP3: bluez, openEuler:22.03-LTS: bluez, openEuler:22.03-LTS-SP1: bluez</p> <p>This package provides all utilities for use in Bluetooth applications. The BLUETOOTH trademarks are owned by Bluetooth SIG, Inc., U.S.A. Security Fix(es): (CVE-2023-27349)</p> https://cve.radiocsirt.org/vuln/oesa-2023-1249 https://cve.radiocsirt.org/vuln/opensuse-su-2024:13128-1 <p>bluez-5.68-2.1 on GA media</p> <p>bluez-5.68-2.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2024:13128-1 https://cve.radiocsirt.org/vuln/suse-su-2023:2533-1 <p>Security update for bluez</p> <p>Security update for bluez</p> https://cve.radiocsirt.org/vuln/suse-su-2023:2533-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2023-27349 <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: bluez, Ubuntu:Pro:18.04:LTS: bluez, Ubuntu:20.04:LTS: bluez, Ubuntu:22.04:LTS: bluez</p> <p>BlueZ Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious device. The specific flaw exists within the handling of the AVRCP protocol. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-19908.</p> <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: bluez, Ubuntu:Pro:18.04:LTS: bluez, Ubuntu:20.04:LTS: bluez, Ubuntu:22.04:LTS: bluez</p> <p>BlueZ Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious device. The specific flaw exists within the handling of the AVRCP protocol. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-19908.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2023-27349 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-1020 <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in bluez ausnutzen, um beliebigen Programmcode mit den Rechten des Dienstes auszuführen.</p> <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in bluez ausnutzen, um beliebigen Programmcode mit den Rechten des Dienstes auszuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2024-1020