bluez (SUSE:Enterprise Storage 7) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the SUSE:Enterprise Storage 7 package bluez, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (10)

• CVE-2021-43400 — CVSS 9.1 (critical): An issue was discovered in gatt-database.c in BlueZ 5.61. A use-after-free can occur when a client disconnects during D-Bus processing of a…
• CVE-2019-8922 — CVSS 8.8 (high): A heap-based buffer overflow was discovered in bluetoothd in BlueZ through 5.48. There isn't any check on whether there is enough space in…
• CVE-2022-39177 — CVSS 8.8 (high): BlueZ before 5.59 allows physically proximate attackers to cause a denial of service because malformed and invalid capabilities can be…
• CVE-2022-39176 — CVSS 8.8 (high): BlueZ before 5.59 allows physically proximate attackers to obtain sensitive information because profiles/audio/avrcp.c does not validate…
• CVE-2022-0204 — CVSS 8.8 (high): A heap overflow vulnerability was found in bluez in versions prior to 5.63. An attacker with local network access could pass specially…
• CVE-2023-27349 — CVSS 8.0 (high): BlueZ Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows…
• CVE-2021-3658 — CVSS 6.5 (medium): bluetoothd from bluez incorrectly saves adapters' Discoverable status when a device is powered down, and restores it when powered up. If a…
• CVE-2019-8921 — CVSS 6.5 (medium): An issue was discovered in bluetoothd in BlueZ through 5.48. The vulnerability lies in the handling of a SVC_ATTR_REQ by the SDP…
• CVE-2021-0129 — CVSS 5.7 (medium): Improper access control in BlueZ may allow an authenticated user to potentially enable information disclosure via adjacent access.
• CVE-2020-26558 — CVSS 4.2 (medium): Bluetooth LE and BR/EDR secure pairing in Bluetooth Core Specification 2.1 through 5.2 may permit a nearby man-in-the-middle attacker to…