Skip to content
OpenAdvisories
High DLA-3879-1 9 CVEs

bluez - security update

Published Sep 7, 2024 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 11 bluez 5.55-3.1+deb11u2

Vulnerabilities 9

  • High 8.8
    CVE-2022-0204

    A heap overflow vulnerability was found in bluez in versions prior to 5.63. An attacker with local network access could…

    bluez bluez Debian Ubuntu
  • High 8.8
    CVE-2022-39176

    BlueZ before 5.59 allows physically proximate attackers to obtain sensitive information because profiles/audio/avrcp.c …

    bluez bluez Debian Ubuntu
  • High 8.8
    CVE-2022-39177

    BlueZ before 5.59 allows physically proximate attackers to cause a denial of service because malformed and invalid capa…

    bluez bluez Debian Ubuntu
  • High 7.1
    CVE-2023-27349

    BlueZ Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability

    BlueZ Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code via Bluetooth on affected installations of BlueZ. User interaction is required to …

    BlueZ BlueZ bluez bluez Debian Ubuntu
  • High 7.1
    CVE-2023-50229

    BlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution Vulnerability

    BlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. User interaction is required to exploit this vul…

    BlueZ BlueZ bluez bluez Debian Ubuntu Azure Linux
  • High 7.1
    CVE-2023-50230

    BlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution Vulnerability

    BlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. User interaction is required to exploit this vul…

    BlueZ BlueZ bluez bluez Debian Ubuntu Azure Linux
  • Medium 6.5
    CVE-2021-3658

    bluetoothd from bluez incorrectly saves adapters' Discoverable status when a device is powered down, and restores it wh…

    bluez bluez Debian Ubuntu
  • Medium 4.3
    CVE-2021-41229

    Memory leak in BlueZ

    BlueZ is a Bluetooth protocol stack for Linux. In affected versions a vulnerability exists in sdp_cstate_alloc_buf which allocates memory which will always be hung in the singly linked list of cstates and will not be freed. This will cause a memory leak over …

    BlueZ BlueZ bluez bluez Debian Ubuntu
  • Unscored —
    CVE-2021-43400

    An issue was discovered in gatt-database.c in BlueZ 5.61. A use-after-free can occur when a client disconnects during D…

    bluez bluez Debian Ubuntu