SB2024060587 - Ubuntu update for bluez 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2024060587

SB2024060587 - Ubuntu update for bluez

Published: June 5, 2024

Security Bulletin ID SB2024060587
Severity
Low
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Physical access
Highest impact Code execution

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) NULL pointer dereference (CVE-ID: CVE-2022-3563)

The vulnerability allows an attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error within the read_50_controller_cap_complete() function in tools/mgmt-tester.c of the component BlueZ. An attacker with physical proximity to device can send specially crafted data to the application and perform a denial of service (DoS) attack.


2) Buffer overflow (CVE-ID: CVE-2023-27349)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the handling of the AVRCP protocol. A remote attacker with physical proximity to device can send specially crafted Bluetooth packets to the affected system, trigger memory corruption and execute arbitrary code on the system.



Remediation

Install update from vendor's website.

References