Skip to content
OpenAdvisories
Medium RLSA-2025:4043 2 CVEs

Moderate: bluez security update

Published Jul 29, 2025 · Updated Jul 29, 2025

Ecosystem: Rocky Linux

Summary

The bluez packages contain the following utilities for use in Bluetooth applications: hcitool, hciattach, hciconfig, bluetoothd, l2ping, start scripts (Rocky Enterprise Software Foundation), and pcmcia configuration files.

Security Fix(es):

* BlueZ: Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability (CVE-2023-27349)

* bluez: audio profile avrcp parse_media_element out-of-bounds read information disclosure vulnerability (CVE-2023-51589)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 1

ReleasePackageFixed in
Rocky Linux · 8 bluez 0:5.63-5.el8_10

Vulnerabilities 2

  • High 7.1
    CVE-2023-27349

    BlueZ Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability

    BlueZ Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code via Bluetooth on affected installations of BlueZ. User interaction is required to …

    BlueZ BlueZ bluez bluez Debian Ubuntu
  • Medium 5.4
    CVE-2023-51589

    BlueZ Audio Profile AVRCP parse_media_element Out-Of-Bounds Read Information Disclosure Vulnerability

    BlueZ Audio Profile AVRCP parse_media_element Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information via Bluetooth on affected installations of BlueZ. User interaction is…

    BlueZ BlueZ bluez bluez Debian Ubuntu Azure Linux

References

  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2278787
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2278965