Skip to content
OpenAdvisories
High RHSA-2024:9413 10 CVEs

Red Hat Security Advisory: bluez security update

Published Nov 12, 2024 · Updated Aug 7, 2026

Ecosystem: Red Hat

Fixed packages 29

ReleasePackageFixed in
Red Hat · RHEL 9 enterprise_linux:9::appstream bluez-cups 0:5.72-2.el9
Red Hat · RHEL 9 enterprise_linux:9::appstream bluez-cups-debuginfo 0:5.72-2.el9
Red Hat · RHEL 9 enterprise_linux:9::appstream bluez-debuginfo 0:5.72-2.el9
Red Hat · RHEL 9 enterprise_linux:9::appstream bluez-debugsource 0:5.72-2.el9
Red Hat · RHEL 9 enterprise_linux:9::appstream bluez-hid2hci-debuginfo 0:5.72-2.el9
Red Hat · RHEL 9 enterprise_linux:9::appstream bluez-libs-debuginfo 0:5.72-2.el9
Red Hat · RHEL 9 enterprise_linux:9::appstream bluez-libs-devel-debuginfo 0:5.72-2.el9
Red Hat · RHEL 9 enterprise_linux:9::appstream bluez-mesh-debuginfo 0:5.72-2.el9
Red Hat · RHEL 9 enterprise_linux:9::appstream bluez-obexd 0:5.72-2.el9
Red Hat · RHEL 9 enterprise_linux:9::appstream bluez-obexd-debuginfo 0:5.72-2.el9
Red Hat · RHEL 9 enterprise_linux:9::baseos bluez 0:5.72-2.el9
Red Hat · RHEL 9 enterprise_linux:9::baseos bluez-cups-debuginfo 0:5.72-2.el9
Red Hat · RHEL 9 enterprise_linux:9::baseos bluez-debuginfo 0:5.72-2.el9
Red Hat · RHEL 9 enterprise_linux:9::baseos bluez-debugsource 0:5.72-2.el9
Red Hat · RHEL 9 enterprise_linux:9::baseos bluez-hid2hci-debuginfo 0:5.72-2.el9
Red Hat · RHEL 9 enterprise_linux:9::baseos bluez-libs 0:5.72-2.el9
Red Hat · RHEL 9 enterprise_linux:9::baseos bluez-libs-debuginfo 0:5.72-2.el9
Red Hat · RHEL 9 enterprise_linux:9::baseos bluez-libs-devel-debuginfo 0:5.72-2.el9
Red Hat · RHEL 9 enterprise_linux:9::baseos bluez-mesh-debuginfo 0:5.72-2.el9
Red Hat · RHEL 9 enterprise_linux:9::baseos bluez-obexd-debuginfo 0:5.72-2.el9
Red Hat · RHEL 9 enterprise_linux:9::crb bluez-cups-debuginfo 0:5.72-2.el9
Red Hat · RHEL 9 enterprise_linux:9::crb bluez-debuginfo 0:5.72-2.el9
Red Hat · RHEL 9 enterprise_linux:9::crb bluez-debugsource 0:5.72-2.el9
Red Hat · RHEL 9 enterprise_linux:9::crb bluez-hid2hci-debuginfo 0:5.72-2.el9
Red Hat · RHEL 9 enterprise_linux:9::crb bluez-libs-debuginfo 0:5.72-2.el9
Red Hat · RHEL 9 enterprise_linux:9::crb bluez-libs-devel 0:5.72-2.el9
Red Hat · RHEL 9 enterprise_linux:9::crb bluez-libs-devel-debuginfo 0:5.72-2.el9
Red Hat · RHEL 9 enterprise_linux:9::crb bluez-mesh-debuginfo 0:5.72-2.el9
Red Hat · RHEL 9 enterprise_linux:9::crb bluez-obexd-debuginfo 0:5.72-2.el9

Vulnerabilities 10

  • High 7.1
    CVE-2023-27349

    BlueZ Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability

    BlueZ Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code via Bluetooth on affected installations of BlueZ. User interaction is required to …

    BlueZ BlueZ bluez bluez Debian Ubuntu
  • High 7.1
    CVE-2023-44431

    BlueZ Audio Profile AVRCP Stack-based Buffer Overflow Remote Code Execution Vulnerability

    BlueZ Audio Profile AVRCP Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code via Bluetooth on affected installations of BlueZ. User interaction is required to exploit…

    BlueZ BlueZ bluez bluez Debian Ubuntu
  • High 7.1
    CVE-2023-50229

    BlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution Vulnerability

    BlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. User interaction is required to exploit this vul…

    BlueZ BlueZ bluez bluez Debian Ubuntu Azure Linux
  • High 7.1
    CVE-2023-50230

    BlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution Vulnerability

    BlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. User interaction is required to exploit this vul…

    BlueZ BlueZ bluez bluez Debian Ubuntu Azure Linux
  • High 7.1
    CVE-2023-51596

    BlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution Vulnerability

    BlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. User interaction is required to exploit this vul…

    BlueZ BlueZ bluez bluez Debian Ubuntu
  • Medium 5.4
    CVE-2023-51580

    BlueZ Audio Profile AVRCP avrcp_parse_attribute_list Out-Of-Bounds Read Information Disclosure Vulnerability

    BlueZ Audio Profile AVRCP avrcp_parse_attribute_list Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information via Bluetooth on affected installations of BlueZ. User interac…

    BlueZ BlueZ bluez bluez Debian Ubuntu Azure Linux
  • Medium 5.4
    CVE-2023-51589

    BlueZ Audio Profile AVRCP parse_media_element Out-Of-Bounds Read Information Disclosure Vulnerability

    BlueZ Audio Profile AVRCP parse_media_element Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information via Bluetooth on affected installations of BlueZ. User interaction is…

    BlueZ BlueZ bluez bluez Debian Ubuntu Azure Linux
  • Medium 5.4
    CVE-2023-51592

    BlueZ Audio Profile AVRCP parse_media_folder Out-Of-Bounds Read Information Disclosure Vulnerability

    BlueZ Audio Profile AVRCP parse_media_folder Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information via Bluetooth on affected installations of BlueZ. User interaction is …

    BlueZ BlueZ bluez bluez Debian Ubuntu Azure Linux
  • Low 2.6
    CVE-2023-51594

    BlueZ OBEX Library Out-Of-Bounds Read Information Disclosure Vulnerability

    BlueZ OBEX Library Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of BlueZ. User interaction is required to exploit this vulnerability i…

    BlueZ BlueZ bluez bluez Debian Ubuntu
  • Unscored —
    CVE-2023-45866 Public exploit

    Bluetooth HID Hosts in BlueZ may permit an unauthenticated Peripheral role HID Device to initiate and establish an encr…

    bluez bluez bluez Debian Ubuntu Azure Linux

References

  • article
    https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/9.5_release_notes/index
  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2253391
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2278787
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2278945
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2278955
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2278962
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2278965
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2278967
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2278969
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2278972
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2278974
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_9413.json
  • report
    https://access.redhat.com/security/cve/CVE-2023-27349
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-27349
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-27349
  • article
    https://www.zerodayinitiative.com/advisories/ZDI-23-386/
  • report
    https://access.redhat.com/security/cve/CVE-2023-44431
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-44431
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-44431
  • report
    https://access.redhat.com/security/cve/CVE-2023-45866
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-45866
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-45866
  • report
    https://access.redhat.com/security/cve/CVE-2023-50229
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-50229
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-50229
  • report
    https://access.redhat.com/security/cve/CVE-2023-50230
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-50230
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-50230
  • report
    https://access.redhat.com/security/cve/CVE-2023-51580
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-51580
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-51580
  • report
    https://access.redhat.com/security/cve/CVE-2023-51589
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-51589
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-51589
  • report
    https://access.redhat.com/security/cve/CVE-2023-51592
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-51592
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-51592
  • report
    https://access.redhat.com/security/cve/CVE-2023-51594