RHSA-2024:9413MediumCVSS 7.1

Red Hat Security Advisory: bluez security update

Published
November 12, 2024
Last Modified
August 6, 2026

🔗 CVE IDs covered (10)

CVE-2023-27349 →CVE-2023-44431 →CVE-2023-45866 →CVE-2023-50230 →CVE-2023-51580 →CVE-2023-51589 →CVE-2023-51592 →CVE-2023-51594 →CVE-2023-50229 →CVE-2023-51596 →

📋 Description

CVE-2023-27349 — BlueZ: Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability CVE-2023-44431 — bluez: AVRCP stack-based buffer overflow remote code execution vulnerability CVE-2023-45866 — bluez: unauthorized HID device connections allows keystroke injection and arbitrary commands execution CVE-2023-50229 — bluez: phone book access profile heap-based buffer overflow remote code execution vulnerability CVE-2023-50230 — bluez: phone book access profile heap-based buffer overflow remote code execution vulnerability CVE-2023-51580 — bluez: avrcp_parse_attribute_list out-of-bounds read information disclosure vulnerability CVE-2023-51589 — bluez: audio profile avrcp parse_media_element out-of-bounds read information disclosure vulnerability CVE-2023-51592 — bluez: audio profile avrcp parse_media_folder out-of-bounds read information disclosure vulnerability CVE-2023-51594 — bluez: OBEX library out-of-bounds read information disclosure vulnerability CVE-2023-51596 — bluez: phone book access profile heap-based buffer overflow remote code execution vulnerability

🎯 Affected products137

  • Red Hat CodeReady Linux Builder (v. 9)
  • Red Hat Enterprise Linux AppStream (v. 9)
  • Red Hat Enterprise Linux BaseOS (v. 9)
  • bluez-0:5.72-2.el9.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • bluez-0:5.72-2.el9.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • bluez-0:5.72-2.el9.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • bluez-0:5.72-2.el9.src as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • bluez-0:5.72-2.el9.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • bluez-cups-0:5.72-2.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bluez-cups-0:5.72-2.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bluez-cups-0:5.72-2.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bluez-cups-0:5.72-2.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bluez-cups-debuginfo-0:5.72-2.el9.aarch64 as a component of Red Hat CodeReady Linux Builder (v. 9)
  • bluez-cups-debuginfo-0:5.72-2.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bluez-cups-debuginfo-0:5.72-2.el9.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • bluez-cups-debuginfo-0:5.72-2.el9.i686 as a component of Red Hat CodeReady Linux Builder (v. 9)
  • bluez-cups-debuginfo-0:5.72-2.el9.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • bluez-cups-debuginfo-0:5.72-2.el9.ppc64le as a component of Red Hat CodeReady Linux Builder (v. 9)
  • bluez-cups-debuginfo-0:5.72-2.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bluez-cups-debuginfo-0:5.72-2.el9.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • bluez-cups-debuginfo-0:5.72-2.el9.s390x as a component of Red Hat CodeReady Linux Builder (v. 9)
  • bluez-cups-debuginfo-0:5.72-2.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bluez-cups-debuginfo-0:5.72-2.el9.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • bluez-cups-debuginfo-0:5.72-2.el9.x86_64 as a component of Red Hat CodeReady Linux Builder (v. 9)
  • bluez-cups-debuginfo-0:5.72-2.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bluez-cups-debuginfo-0:5.72-2.el9.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • bluez-debuginfo-0:5.72-2.el9.aarch64 as a component of Red Hat CodeReady Linux Builder (v. 9)
  • bluez-debuginfo-0:5.72-2.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bluez-debuginfo-0:5.72-2.el9.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • bluez-debuginfo-0:5.72-2.el9.i686 as a component of Red Hat CodeReady Linux Builder (v. 9)
  • +107 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Put Bluetooth device in non-discoverable mode / disable incoming pairing. Or Disable Bluetooth. Instructions on disabling bluetooth in Red Hat Enterprise Linux are available at: https://access.redhat.com/solutions/2682931

🔗 References (14)