An issue was discovered in gatt-database.c in BlueZ 5.61

BlueZ HID over GATT Profile Improper Access Control Remote Code Execution Vulnerability

BlueZ before 5.59 allows physically proximate attackers to cause a denial of service because malformed and invalid capabilities can be processed in profiles/audio/avdtp.c

BlueZ before 5.59 allows physically proximate attackers to obtain sensitive information because profiles/audio/avrcp.c does not validate params_len

A heap overflow vulnerability was found in bluez in versions prior to 5.63

A heap-based buffer overflow was discovered in bluetoothd in BlueZ through 5.48

In BlueZ before 5.55, a double free was found in the gatttool disconnect_cb() routine from shared/att.c

BlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution Vulnerability

BlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution Vulnerability

BlueZ Audio Profile AVRCP Stack-based Buffer Overflow Remote Code Execution Vulnerability

BlueZ Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability

Buffer overflow in BlueZ 5.41 and earlier allows an attacker to execute arbitrary code via the parse_line function used in some userland utilities

In BlueZ 5.42, a buffer overflow was observed in "read_n" function in "tools/hcidump.c" source file

BlueZ A2DP Stack-based Buffer Overflow Remote Code Execution Vulnerability

BlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution Vulnerability

Improper access control in subsystem for BlueZ before version 5.54 may allow an unauthenticated user to potentially enable escalation of privilege and denial of service via…

bluetoothd from bluez incorrectly saves adapters' Discoverable status when a device is powered down, and restores it when powered up

An issue was discovered in bluetoothd in BlueZ through 5.48

BlueZ is a Bluetooth protocol stack for Linux

Improper buffer restrictions in BlueZ may allow an unauthenticated user to potentially enable denial of service via adjacent access

All versions of the SDP server in BlueZ 5.46 and earlier are vulnerable to an information disclosure vulnerability which allows remote attackers to obtain sensitive information…

BlueZ OBEX Library Out-Of-Bounds Read Information Disclosure Vulnerability

BlueZ Audio Profile AVRCP parse_media_folder Out-Of-Bounds Read Information Disclosure Vulnerability

BlueZ Audio Profile AVRCP parse_media_element Out-Of-Bounds Read Information Disclosure Vulnerability

BlueZ Audio Profile AVRCP avrcp_parse_attribute_list Out-Of-Bounds Read Information Disclosure Vulnerability

Linux Kernel BlueZ mgmt-tester.c read_50_controller_cap_complete null pointer dereference

Improper access control in BlueZ may allow an authenticated user to potentially enable information disclosure via adjacent access

Linux Kernel BlueZ jlink.c jlink_init denial of service

In BlueZ 5.42, a buffer overflow was observed in "commands_dump" function in "tools/parser/csr.c" source file

In BlueZ 5.42, an out-of-bounds read was observed in "le_meta_ev_dump" function in "tools/parser/hci.c" source file

In BlueZ 5.42, a buffer over-read was identified in "l2cap_packet" function in "monitor/packet.c" source file

In BlueZ 5.42, a buffer overflow was observed in "set_ext_ctrl" function in "tools/parser/l2cap.c" source file when processing corrupted dump file

In BlueZ 5.42, a buffer overflow was observed in "pin_code_reply_dump" function in "tools/parser/hci.c" source file

In BlueZ 5.42, a buffer overflow was observed in "pklg_read_hci" function in "btsnoop.c" source file

In BlueZ 5.42, a use-after-free was identified in "conf_opt" function in "tools/parser/l2cap.c" source file

In BlueZ 5.42, a buffer over-read was observed in "l2cap_dump" function in "tools/parser/l2cap.c" source file

The cli_feat_read_cb() function in src/gatt-database.c does not perform bounds checks on the 'offset' variable before using it as an index into an array for reading

A bug in Bluez may allow for the Bluetooth Discoverable state being set to on when no Bluetooth agent is registered with the system