bluez (SUSE:Linux Enterprise Server 12 SP5) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the SUSE:Linux Enterprise Server 12 SP5 package bluez, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (10)

• CVE-2022-39176 — CVSS 8.8 (high): BlueZ before 5.59 allows physically proximate attackers to obtain sensitive information because profiles/audio/avrcp.c does not validate…
• CVE-2022-39177 — CVSS 8.8 (high): BlueZ before 5.59 allows physically proximate attackers to cause a denial of service because malformed and invalid capabilities can be…
• CVE-2019-8922 — CVSS 8.8 (high): A heap-based buffer overflow was discovered in bluetoothd in BlueZ through 5.48. There isn't any check on whether there is enough space in…
• CVE-2023-27349 — CVSS 8.0 (high): BlueZ Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows…
• CVE-2019-9853 — CVSS 7.8 (high): LibreOffice documents can contain macros. The execution of those macros is controlled by the document security settings, typically…
• CVE-2020-0556 — CVSS 7.1 (high): Improper access control in subsystem for BlueZ before version 5.54 may allow an unauthenticated user to potentially enable escalation of…
• CVE-2019-8921 — CVSS 6.5 (medium): An issue was discovered in bluetoothd in BlueZ through 5.48. The vulnerability lies in the handling of a SVC_ATTR_REQ by the SDP…
• CVE-2016-9798 — CVSS 5.3 (medium): In BlueZ 5.42, a use-after-free was identified in "conf_opt" function in "tools/parser/l2cap.c" source file. This issue can be triggered by…
• CVE-2016-9803 — CVSS 5.3 (medium): In BlueZ 5.42, an out-of-bounds read was observed in "le_meta_ev_dump" function in "tools/parser/hci.c" source file. This issue exists…
• CVE-2021-41229 — CVSS 4.3 (medium): BlueZ is a Bluetooth protocol stack for Linux. In affected versions a vulnerability exists in sdp_cstate_alloc_buf which allocates memory…