Summary
Lucas Leong discovered that BlueZ incorrectly handled the Phone Book Access
profile. If a user were tricked into connecting to a malicious Bluetooth
device, a remote attacker could possibly use this issue to execute
arbitrary code.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | bluez | 5.53-0ubuntu3.9 |
| Ubuntu · 22.04 LTS 22.04:LTS | bluez | 5.64-0ubuntu1.4 |
Vulnerabilities 2
-
High 7.1
BlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution Vulnerability
BlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. User interaction is required to exploit this vul…
-
High 7.1
BlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution Vulnerability
BlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. User interaction is required to exploit this vul…