Skip to content
OpenAdvisories
High ALAS2-2022-1881 2 CVEs

Important: bluez security update (Amazon Linux 2)

Published Dec 1, 2022 · Updated Jun 7, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-39177: A vulnerability was found in BlueZ. This flaw allows physically proximate attackers to cause a denial of service due to malformed and invalid capabilities processed in profiles/audio/avdtp.c. CVE-2022-39176: A vulnerability was found in BlueZ. This flaw allows physically proximate attackers to obtain sensitive information because the profiles/audio/avrcp.c does not validate params_len.

Fixed packages 6

ReleasePackageFixed in
Amazon Linux · 2 bluez 0:5.44-7.amzn2.0.1
Amazon Linux · 2 bluez-cups 0:5.44-7.amzn2.0.1
Amazon Linux · 2 bluez-debuginfo 0:5.44-7.amzn2.0.1
Amazon Linux · 2 bluez-hid2hci 0:5.44-7.amzn2.0.1
Amazon Linux · 2 bluez-libs 0:5.44-7.amzn2.0.1
Amazon Linux · 2 bluez-libs-devel 0:5.44-7.amzn2.0.1

Vulnerabilities 2

  • High 8.8
    CVE-2022-39176

    BlueZ before 5.59 allows physically proximate attackers to obtain sensitive information because profiles/audio/avrcp.c …

    bluez bluez Debian Ubuntu
  • High 8.8
    CVE-2022-39177

    BlueZ before 5.59 allows physically proximate attackers to cause a denial of service because malformed and invalid capa…

    bluez bluez Debian Ubuntu

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-39176.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-39177.html