Skip to content
OpenAdvisories
Medium RLSA-2024:9413 10 CVEs

Moderate: bluez security update

Published Mar 17, 2025 · Updated Feb 5, 2026

Ecosystem: Rocky Linux

Summary

The bluez packages contain the following utilities for use in Bluetooth applications: hcitool, hciattach, hciconfig, bluetoothd, l2ping, start scripts (Rocky Enterprise Software Foundation), and pcmcia configuration files.

Security Fix(es):

* bluez: unauthorized HID device connections allows keystroke injection and arbitrary commands execution (CVE-2023-45866)

* BlueZ: Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability (CVE-2023-27349)

* bluez: phone book access profile heap-based buffer overflow remote code execution vulnerability (CVE-2023-51596)

* bluez: OBEX library out-of-bounds read information disclosure vulnerability (CVE-2023-51594)

* bluez: audio profile avrcp parse_media_folder out-of-bounds read information disclosure vulnerability (CVE-2023-51592)

* bluez: audio profile avrcp parse_media_element out-of-bounds read information disclosure vulnerability (CVE-2023-51589)

* bluez: avrcp_parse_attribute_list out-of-bounds read information disclosure vulnerability (CVE-2023-51580)

* bluez: AVRCP stack-based buffer overflow remote code execution vulnerability (CVE-2023-44431)

* bluez: phone book access profile heap-based buffer overflow remote code execution vulnerability (CVE-2023-50230)

* bluez: phone book access profile heap-based buffer overflow remote code execution vulnerability (CVE-2023-50229)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 9.5 Release Notes linked from the References section.

Fixed packages 1

ReleasePackageFixed in
Rocky Linux · 9 bluez 0:5.72-2.el9

Vulnerabilities 10

  • High 7.1
    CVE-2023-27349

    BlueZ Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability

    BlueZ Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code via Bluetooth on affected installations of BlueZ. User interaction is required to …

    BlueZ BlueZ bluez bluez Debian Ubuntu
  • High 7.1
    CVE-2023-44431

    BlueZ Audio Profile AVRCP Stack-based Buffer Overflow Remote Code Execution Vulnerability

    BlueZ Audio Profile AVRCP Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code via Bluetooth on affected installations of BlueZ. User interaction is required to exploit…

    BlueZ BlueZ bluez bluez Debian Ubuntu
  • High 7.1
    CVE-2023-50229

    BlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution Vulnerability

    BlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. User interaction is required to exploit this vul…

    BlueZ BlueZ bluez bluez Debian Ubuntu Azure Linux
  • High 7.1
    CVE-2023-50230

    BlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution Vulnerability

    BlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. User interaction is required to exploit this vul…

    BlueZ BlueZ bluez bluez Debian Ubuntu Azure Linux
  • High 7.1
    CVE-2023-51596

    BlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution Vulnerability

    BlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. User interaction is required to exploit this vul…

    BlueZ BlueZ bluez bluez Debian Ubuntu
  • Medium 5.4
    CVE-2023-51580

    BlueZ Audio Profile AVRCP avrcp_parse_attribute_list Out-Of-Bounds Read Information Disclosure Vulnerability

    BlueZ Audio Profile AVRCP avrcp_parse_attribute_list Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information via Bluetooth on affected installations of BlueZ. User interac…

    BlueZ BlueZ bluez bluez Debian Ubuntu Azure Linux
  • Medium 5.4
    CVE-2023-51589

    BlueZ Audio Profile AVRCP parse_media_element Out-Of-Bounds Read Information Disclosure Vulnerability

    BlueZ Audio Profile AVRCP parse_media_element Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information via Bluetooth on affected installations of BlueZ. User interaction is…

    BlueZ BlueZ bluez bluez Debian Ubuntu Azure Linux
  • Medium 5.4
    CVE-2023-51592

    BlueZ Audio Profile AVRCP parse_media_folder Out-Of-Bounds Read Information Disclosure Vulnerability

    BlueZ Audio Profile AVRCP parse_media_folder Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information via Bluetooth on affected installations of BlueZ. User interaction is …

    BlueZ BlueZ bluez bluez Debian Ubuntu Azure Linux
  • Low 2.6
    CVE-2023-51594

    BlueZ OBEX Library Out-Of-Bounds Read Information Disclosure Vulnerability

    BlueZ OBEX Library Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of BlueZ. User interaction is required to exploit this vulnerability i…

    BlueZ BlueZ bluez bluez Debian Ubuntu
  • Unscored —
    CVE-2023-45866 Public exploit

    Bluetooth HID Hosts in BlueZ may permit an unauthenticated Peripheral role HID Device to initiate and establish an encr…

    bluez bluez bluez Debian Ubuntu Azure Linux

References

  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2253391
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2278787
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2278945
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2278955
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2278962
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2278965
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2278967
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2278969
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2278972
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2278974