RHSA-2024:9413

Vulnerability from csaf_opensuse - Published: 2024-11-12 00:00 - Updated: 2026-09-20 11:44
Summary
security update for bluez
Severity
Low
Notes
Title of the patch: security update for bluez
Description of the patch: This security update provides a functional equivalent of RHSA-2024:9413. The original Red Hat(R) advisory is available from the Red Hat web site at https://access.redhat.com/errata/RHSA-2024:9413.
Patchnames: RHSA-2024:9413
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
CVE-2023-27349
8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Product Identifier Version Remediation
Unresolved product id: SUSE Liberty Linux 9:bluez-0:5.72-2.el9.x86_64 —
Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:bluez-cups-0:5.72-2.el9.x86_64 —
Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:bluez-libs-0:5.72-2.el9.i686 —
Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:bluez-libs-0:5.72-2.el9.x86_64 —
Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:bluez-libs-devel-0:5.72-2.el9.i686 —
Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:bluez-libs-devel-0:5.72-2.el9.x86_64 —
Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:bluez-obexd-0:5.72-2.el9.x86_64 —
Vendor Fix
Threats
Impact important
CVE-2023-44431
7.1 (High)
CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Recommended 7 products, the same list as for CVE-2023-27349
Threats
Impact important
CVE-2023-45866
6.3 (Medium)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Affected products
Recommended 7 products, the same list as for CVE-2023-27349
Threats
Impact moderate
CVE-2023-50229
7.1 (High)
CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Recommended 7 products, the same list as for CVE-2023-27349
Threats
Impact important
CVE-2023-50230
7.1 (High)
CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Recommended 7 products, the same list as for CVE-2023-27349
Threats
Impact important
CVE-2023-51580
5.4 (Medium)
CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:L
Affected products
Recommended 7 products, the same list as for CVE-2023-27349
Threats
Impact moderate
CVE-2023-51589
5.4 (Medium)
CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:L
Affected products
Recommended 7 products, the same list as for CVE-2023-27349
Threats
Impact moderate
CVE-2023-51592
5.4 (Medium)
CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:L
Affected products
Recommended 7 products, the same list as for CVE-2023-27349
Threats
Impact moderate
CVE-2023-51594
2.6 (Low)
CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Affected products
Recommended 7 products, the same list as for CVE-2023-27349
Threats
Impact low
CVE-2023-51596
7.1 (High)
CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Recommended 7 products, the same list as for CVE-2023-27349
Threats
Impact important
References
URL Category
https://www.suse.com/support/security/rating/ external
https://ftp.suse.com/pub/projects/security/csaf/r… self
https://lists.suse.com/pipermail/suse-liberty-lin… self
https://lists.suse.com/pipermail/suse-liberty-lin… self
https://www.suse.com/security/cve/CVE-2023-27349/ self
https://www.suse.com/security/cve/CVE-2023-44431/ self
https://www.suse.com/security/cve/CVE-2023-45866/ self
https://www.suse.com/security/cve/CVE-2023-50229/ self
https://www.suse.com/security/cve/CVE-2023-50230/ self
https://www.suse.com/security/cve/CVE-2023-51580/ self
https://www.suse.com/security/cve/CVE-2023-51589/ self
https://www.suse.com/security/cve/CVE-2023-51592/ self
https://www.suse.com/security/cve/CVE-2023-51594/ self
https://www.suse.com/security/cve/CVE-2023-51596/ self
https://www.suse.com/security/cve/CVE-2023-27349 external
https://bugzilla.suse.com/1210398 external
https://www.suse.com/security/cve/CVE-2023-44431 external
https://bugzilla.suse.com/1223974 external
https://www.suse.com/security/cve/CVE-2023-45866 external
https://bugzilla.suse.com/1217877 external
https://www.suse.com/security/cve/CVE-2023-50229 external
https://bugzilla.suse.com/1218300 external
https://www.suse.com/security/cve/CVE-2023-50230 external
https://bugzilla.suse.com/1218301 external
https://www.suse.com/security/cve/CVE-2023-51580 external
https://bugzilla.suse.com/1218337 external
https://www.suse.com/security/cve/CVE-2023-51589 external
https://bugzilla.suse.com/1218341 external
https://www.suse.com/security/cve/CVE-2023-51592 external
https://bugzilla.suse.com/1218340 external
https://www.suse.com/security/cve/CVE-2023-51594 external
https://bugzilla.suse.com/1218339 external
https://www.suse.com/security/cve/CVE-2023-51596 external
https://bugzilla.suse.com/1218338 external
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "Low"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "security update for bluez",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This security update provides a functional equivalent of RHSA-2024:9413.\nThe original Red Hat(R) advisory is available from the Red Hat web site at\nhttps://access.redhat.com/errata/RHSA-2024:9413.\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "RHSA-2024:9413",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/rhsa-2024_9413.json"
      },
      {
        "category": "self",
        "summary": "URL for RHSA-2024:9413",
        "url": "https://lists.suse.com/pipermail/suse-liberty-linux-updates/2024-November/000583.html"
      },
      {
        "category": "self",
        "summary": "E-Mail link for RHSA-2024:9413",
        "url": "https://lists.suse.com/pipermail/suse-liberty-linux-updates/2024-November/000583.html"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-27349 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-27349/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-44431 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-44431/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-45866 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-45866/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-50229 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-50229/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-50230 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-50230/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-51580 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-51580/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-51589 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-51589/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-51592 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-51592/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-51594 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-51594/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-51596 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-51596/"
      }
    ],
    "title": "security update for bluez",
    "tracking": {
      "current_release_date": "2026-09-20T11:44:46Z",
      "generator": {
        "date": "2024-11-12T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "RHSA-2024:9413",
      "initial_release_date": "2024-11-12T00:00:00Z",
      "revision_history": [
        {
          "date": "2024-11-12T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-20T11:44:46Z",
          "number": "2",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "bluez-libs-0:5.72-2.el9.i686",
                "product": {
                  "name": "bluez-libs-0:5.72-2.el9.i686",
                  "product_id": "bluez-libs-0:5.72-2.el9.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/bluez-libs@5.72-2.el9?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "bluez-libs-devel-0:5.72-2.el9.i686",
                "product": {
                  "name": "bluez-libs-devel-0:5.72-2.el9.i686",
                  "product_id": "bluez-libs-devel-0:5.72-2.el9.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/bluez-libs-devel@5.72-2.el9?arch=i686"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "bluez-0:5.72-2.el9.x86_64",
                "product": {
                  "name": "bluez-0:5.72-2.el9.x86_64",
                  "product_id": "bluez-0:5.72-2.el9.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:bluez:bluez:5.72:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/bluez@5.72-2.el9?arch=x86_64\u0026upstream=bluez-0:5.72-2.el9.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "bluez-cups-0:5.72-2.el9.x86_64",
                "product": {
                  "name": "bluez-cups-0:5.72-2.el9.x86_64",
                  "product_id": "bluez-cups-0:5.72-2.el9.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:bluez:bluez:5.72:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/bluez-cups@5.72-2.el9?arch=x86_64\u0026upstream=bluez-0:5.72-2.el9.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "bluez-libs-0:5.72-2.el9.x86_64",
                "product": {
                  "name": "bluez-libs-0:5.72-2.el9.x86_64",
                  "product_id": "bluez-libs-0:5.72-2.el9.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/bluez-libs@5.72-2.el9?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "bluez-libs-devel-0:5.72-2.el9.x86_64",
                "product": {
                  "name": "bluez-libs-devel-0:5.72-2.el9.x86_64",
                  "product_id": "bluez-libs-devel-0:5.72-2.el9.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/bluez-libs-devel@5.72-2.el9?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "bluez-obexd-0:5.72-2.el9.x86_64",
                "product": {
                  "name": "bluez-obexd-0:5.72-2.el9.x86_64",
                  "product_id": "bluez-obexd-0:5.72-2.el9.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:bluez:bluez:5.72:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/bluez-obexd@5.72-2.el9?arch=x86_64\u0026upstream=bluez-0:5.72-2.el9.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Liberty Linux 9",
                "product": {
                  "name": "SUSE Liberty Linux 9",
                  "product_id": "SUSE Liberty Linux 9",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sll:9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "bluez-0:5.72-2.el9.x86_64 as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:bluez-0:5.72-2.el9.x86_64"
        },
        "product_reference": "bluez-0:5.72-2.el9.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "bluez-cups-0:5.72-2.el9.x86_64 as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:bluez-cups-0:5.72-2.el9.x86_64"
        },
        "product_reference": "bluez-cups-0:5.72-2.el9.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "bluez-libs-0:5.72-2.el9.i686 as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:bluez-libs-0:5.72-2.el9.i686"
        },
        "product_reference": "bluez-libs-0:5.72-2.el9.i686",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "bluez-libs-0:5.72-2.el9.x86_64 as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:bluez-libs-0:5.72-2.el9.x86_64"
        },
        "product_reference": "bluez-libs-0:5.72-2.el9.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "bluez-libs-devel-0:5.72-2.el9.i686 as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:bluez-libs-devel-0:5.72-2.el9.i686"
        },
        "product_reference": "bluez-libs-devel-0:5.72-2.el9.i686",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "bluez-libs-devel-0:5.72-2.el9.x86_64 as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:bluez-libs-devel-0:5.72-2.el9.x86_64"
        },
        "product_reference": "bluez-libs-devel-0:5.72-2.el9.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "bluez-obexd-0:5.72-2.el9.x86_64 as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:bluez-obexd-0:5.72-2.el9.x86_64"
        },
        "product_reference": "bluez-obexd-0:5.72-2.el9.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-27349",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-27349"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "BlueZ Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious device.\n\nThe specific flaw exists within the handling of the AVRCP protocol. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-19908.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 9:bluez-0:5.72-2.el9.x86_64",
          "SUSE Liberty Linux 9:bluez-cups-0:5.72-2.el9.x86_64",
          "SUSE Liberty Linux 9:bluez-libs-0:5.72-2.el9.i686",
          "SUSE Liberty Linux 9:bluez-libs-0:5.72-2.el9.x86_64",
          "SUSE Liberty Linux 9:bluez-libs-devel-0:5.72-2.el9.i686",
          "SUSE Liberty Linux 9:bluez-libs-devel-0:5.72-2.el9.x86_64",
          "SUSE Liberty Linux 9:bluez-obexd-0:5.72-2.el9.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-27349",
          "url": "https://www.suse.com/security/cve/CVE-2023-27349"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1210398 for CVE-2023-27349",
          "url": "https://bugzilla.suse.com/1210398"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 9:bluez-0:5.72-2.el9.x86_64",
            "SUSE Liberty Linux 9:bluez-cups-0:5.72-2.el9.x86_64",
            "SUSE Liberty Linux 9:bluez-libs-0:5.72-2.el9.i686",
            "SUSE Liberty Linux 9:bluez-libs-0:5.72-2.el9.x86_64",
            "SUSE Liberty Linux 9:bluez-libs-devel-0:5.72-2.el9.i686",
            "SUSE Liberty Linux 9:bluez-libs-devel-0:5.72-2.el9.x86_64",
            "SUSE Liberty Linux 9:bluez-obexd-0:5.72-2.el9.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 9:bluez-0:5.72-2.el9.x86_64",
            "SUSE Liberty Linux 9:bluez-cups-0:5.72-2.el9.x86_64",
            "SUSE Liberty Linux 9:bluez-libs-0:5.72-2.el9.i686",
            "SUSE Liberty Linux 9:bluez-libs-0:5.72-2.el9.x86_64",
            "SUSE Liberty Linux 9:bluez-libs-devel-0:5.72-2.el9.i686",
            "SUSE Liberty Linux 9:bluez-libs-devel-0:5.72-2.el9.x86_64",
            "SUSE Liberty Linux 9:bluez-obexd-0:5.72-2.el9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-12T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2023-27349"
    },
    {
      "cve": "CVE-2023-44431",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-44431"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "BlueZ Audio Profile AVRCP Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious device.\n\nThe specific flaw exists within the handling of the AVRCP protocol. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-19909.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 9:bluez-0:5.72-2.el9.x86_64",
          "SUSE Liberty Linux 9:bluez-cups-0:5.72-2.el9.x86_64",
          "SUSE Liberty Linux 9:bluez-libs-0:5.72-2.el9.i686",
          "SUSE Liberty Linux 9:bluez-libs-0:5.72-2.el9.x86_64",
          "SUSE Liberty Linux 9:bluez-libs-devel-0:5.72-2.el9.i686",
          "SUSE Liberty Linux 9:bluez-libs-devel-0:5.72-2.el9.x86_64",
          "SUSE Liberty Linux 9:bluez-obexd-0:5.72-2.el9.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-44431",
          "url": "https://www.suse.com/security/cve/CVE-2023-44431"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1223974 for CVE-2023-44431",
          "url": "https://bugzilla.suse.com/1223974"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 9:bluez-0:5.72-2.el9.x86_64",
            "SUSE Liberty Linux 9:bluez-cups-0:5.72-2.el9.x86_64",
            "SUSE Liberty Linux 9:bluez-libs-0:5.72-2.el9.i686",
            "SUSE Liberty Linux 9:bluez-libs-0:5.72-2.el9.x86_64",
            "SUSE Liberty Linux 9:bluez-libs-devel-0:5.72-2.el9.i686",
            "SUSE Liberty Linux 9:bluez-libs-devel-0:5.72-2.el9.x86_64",
            "SUSE Liberty Linux 9:bluez-obexd-0:5.72-2.el9.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 9:bluez-0:5.72-2.el9.x86_64",
            "SUSE Liberty Linux 9:bluez-cups-0:5.72-2.el9.x86_64",
            "SUSE Liberty Linux 9:bluez-libs-0:5.72-2.el9.i686",
            "SUSE Liberty Linux 9:bluez-libs-0:5.72-2.el9.x86_64",
            "SUSE Liberty Linux 9:bluez-libs-devel-0:5.72-2.el9.i686",
            "SUSE Liberty Linux 9:bluez-libs-devel-0:5.72-2.el9.x86_64",
            "SUSE Liberty Linux 9:bluez-obexd-0:5.72-2.el9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-12T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2023-44431"
    },
    {
      "cve": "CVE-2023-45866",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-45866"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Bluetooth HID Hosts in BlueZ may permit an unauthenticated Peripheral role HID Device to initiate and establish an encrypted connection, and accept HID keyboard reports, potentially permitting injection of HID messages when no user interaction has occurred in the Central role to authorize such access. An example affected package is bluez 5.64-0ubuntu1 in Ubuntu 22.04LTS. NOTE: in some cases, a CVE-2020-0556 mitigation would have already addressed this Bluetooth HID Hosts issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 9:bluez-0:5.72-2.el9.x86_64",
          "SUSE Liberty Linux 9:bluez-cups-0:5.72-2.el9.x86_64",
          "SUSE Liberty Linux 9:bluez-libs-0:5.72-2.el9.i686",
          "SUSE Liberty Linux 9:bluez-libs-0:5.72-2.el9.x86_64",
          "SUSE Liberty Linux 9:bluez-libs-devel-0:5.72-2.el9.i686",
          "SUSE Liberty Linux 9:bluez-libs-devel-0:5.72-2.el9.x86_64",
          "SUSE Liberty Linux 9:bluez-obexd-0:5.72-2.el9.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-45866",
          "url": "https://www.suse.com/security/cve/CVE-2023-45866"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1217877 for CVE-2023-45866",
          "url": "https://bugzilla.suse.com/1217877"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 9:bluez-0:5.72-2.el9.x86_64",
            "SUSE Liberty Linux 9:bluez-cups-0:5.72-2.el9.x86_64",
            "SUSE Liberty Linux 9:bluez-libs-0:5.72-2.el9.i686",
            "SUSE Liberty Linux 9:bluez-libs-0:5.72-2.el9.x86_64",
            "SUSE Liberty Linux 9:bluez-libs-devel-0:5.72-2.el9.i686",
            "SUSE Liberty Linux 9:bluez-libs-devel-0:5.72-2.el9.x86_64",
            "SUSE Liberty Linux 9:bluez-obexd-0:5.72-2.el9.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 9:bluez-0:5.72-2.el9.x86_64",
            "SUSE Liberty Linux 9:bluez-cups-0:5.72-2.el9.x86_64",
            "SUSE Liberty Linux 9:bluez-libs-0:5.72-2.el9.i686",
            "SUSE Liberty Linux 9:bluez-libs-0:5.72-2.el9.x86_64",
            "SUSE Liberty Linux 9:bluez-libs-devel-0:5.72-2.el9.i686",
            "SUSE Liberty Linux 9:bluez-libs-devel-0:5.72-2.el9.x86_64",
            "SUSE Liberty Linux 9:bluez-obexd-0:5.72-2.el9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-12T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2023-45866"
    },
    {
      "cve": "CVE-2023-50229",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-50229"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "BlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious Bluetooth device.\n\nThe specific flaw exists within the handling of the Phone Book Access profile. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-20936.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 9:bluez-0:5.72-2.el9.x86_64",
          "SUSE Liberty Linux 9:bluez-cups-0:5.72-2.el9.x86_64",
          "SUSE Liberty Linux 9:bluez-libs-0:5.72-2.el9.i686",
          "SUSE Liberty Linux 9:bluez-libs-0:5.72-2.el9.x86_64",
          "SUSE Liberty Linux 9:bluez-libs-devel-0:5.72-2.el9.i686",
          "SUSE Liberty Linux 9:bluez-libs-devel-0:5.72-2.el9.x86_64",
          "SUSE Liberty Linux 9:bluez-obexd-0:5.72-2.el9.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-50229",
          "url": "https://www.suse.com/security/cve/CVE-2023-50229"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1218300 for CVE-2023-50229",
          "url": "https://bugzilla.suse.com/1218300"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 9:bluez-0:5.72-2.el9.x86_64",
            "SUSE Liberty Linux 9:bluez-cups-0:5.72-2.el9.x86_64",
            "SUSE Liberty Linux 9:bluez-libs-0:5.72-2.el9.i686",
            "SUSE Liberty Linux 9:bluez-libs-0:5.72-2.el9.x86_64",
            "SUSE Liberty Linux 9:bluez-libs-devel-0:5.72-2.el9.i686",
            "SUSE Liberty Linux 9:bluez-libs-devel-0:5.72-2.el9.x86_64",
            "SUSE Liberty Linux 9:bluez-obexd-0:5.72-2.el9.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 9:bluez-0:5.72-2.el9.x86_64",
            "SUSE Liberty Linux 9:bluez-cups-0:5.72-2.el9.x86_64",
            "SUSE Liberty Linux 9:bluez-libs-0:5.72-2.el9.i686",
            "SUSE Liberty Linux 9:bluez-libs-0:5.72-2.el9.x86_64",
            "SUSE Liberty Linux 9:bluez-libs-devel-0:5.72-2.el9.i686",
            "SUSE Liberty Linux 9:bluez-libs-devel-0:5.72-2.el9.x86_64",
            "SUSE Liberty Linux 9:bluez-obexd-0:5.72-2.el9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-12T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2023-50229"
    },
    {
      "cve": "CVE-2023-50230",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-50230"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "BlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious Bluetooth device.\n\nThe specific flaw exists within the handling of the Phone Book Access profile. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-20938.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 9:bluez-0:5.72-2.el9.x86_64",
          "SUSE Liberty Linux 9:bluez-cups-0:5.72-2.el9.x86_64",
          "SUSE Liberty Linux 9:bluez-libs-0:5.72-2.el9.i686",
          "SUSE Liberty Linux 9:bluez-libs-0:5.72-2.el9.x86_64",
          "SUSE Liberty Linux 9:bluez-libs-devel-0:5.72-2.el9.i686",
          "SUSE Liberty Linux 9:bluez-libs-devel-0:5.72-2.el9.x86_64",
          "SUSE Liberty Linux 9:bluez-obexd-0:5.72-2.el9.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-50230",
          "url": "https://www.suse.com/security/cve/CVE-2023-50230"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1218301 for CVE-2023-50230",
          "url": "https://bugzilla.suse.com/1218301"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 9:bluez-0:5.72-2.el9.x86_64",
            "SUSE Liberty Linux 9:bluez-cups-0:5.72-2.el9.x86_64",
            "SUSE Liberty Linux 9:bluez-libs-0:5.72-2.el9.i686",
            "SUSE Liberty Linux 9:bluez-libs-0:5.72-2.el9.x86_64",
            "SUSE Liberty Linux 9:bluez-libs-devel-0:5.72-2.el9.i686",
            "SUSE Liberty Linux 9:bluez-libs-devel-0:5.72-2.el9.x86_64",
            "SUSE Liberty Linux 9:bluez-obexd-0:5.72-2.el9.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 9:bluez-0:5.72-2.el9.x86_64",
            "SUSE Liberty Linux 9:bluez-cups-0:5.72-2.el9.x86_64",
            "SUSE Liberty Linux 9:bluez-libs-0:5.72-2.el9.i686",
            "SUSE Liberty Linux 9:bluez-libs-0:5.72-2.el9.x86_64",
            "SUSE Liberty Linux 9:bluez-libs-devel-0:5.72-2.el9.i686",
            "SUSE Liberty Linux 9:bluez-libs-devel-0:5.72-2.el9.x86_64",
            "SUSE Liberty Linux 9:bluez-obexd-0:5.72-2.el9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-12T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2023-50230"
    },
    {
      "cve": "CVE-2023-51580",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-51580"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "BlueZ Audio Profile AVRCP avrcp_parse_attribute_list Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious device.\n\nThe specific flaw exists within the handling of the AVRCP protocol. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-20852.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 9:bluez-0:5.72-2.el9.x86_64",
          "SUSE Liberty Linux 9:bluez-cups-0:5.72-2.el9.x86_64",
          "SUSE Liberty Linux 9:bluez-libs-0:5.72-2.el9.i686",
          "SUSE Liberty Linux 9:bluez-libs-0:5.72-2.el9.x86_64",
          "SUSE Liberty Linux 9:bluez-libs-devel-0:5.72-2.el9.i686",
          "SUSE Liberty Linux 9:bluez-libs-devel-0:5.72-2.el9.x86_64",
          "SUSE Liberty Linux 9:bluez-obexd-0:5.72-2.el9.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-51580",
          "url": "https://www.suse.com/security/cve/CVE-2023-51580"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1218337 for CVE-2023-51580",
          "url": "https://bugzilla.suse.com/1218337"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 9:bluez-0:5.72-2.el9.x86_64",
            "SUSE Liberty Linux 9:bluez-cups-0:5.72-2.el9.x86_64",
            "SUSE Liberty Linux 9:bluez-libs-0:5.72-2.el9.i686",
            "SUSE Liberty Linux 9:bluez-libs-0:5.72-2.el9.x86_64",
            "SUSE Liberty Linux 9:bluez-libs-devel-0:5.72-2.el9.i686",
            "SUSE Liberty Linux 9:bluez-libs-devel-0:5.72-2.el9.x86_64",
            "SUSE Liberty Linux 9:bluez-obexd-0:5.72-2.el9.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 9:bluez-0:5.72-2.el9.x86_64",
            "SUSE Liberty Linux 9:bluez-cups-0:5.72-2.el9.x86_64",
            "SUSE Liberty Linux 9:bluez-libs-0:5.72-2.el9.i686",
            "SUSE Liberty Linux 9:bluez-libs-0:5.72-2.el9.x86_64",
            "SUSE Liberty Linux 9:bluez-libs-devel-0:5.72-2.el9.i686",
            "SUSE Liberty Linux 9:bluez-libs-devel-0:5.72-2.el9.x86_64",
            "SUSE Liberty Linux 9:bluez-obexd-0:5.72-2.el9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-12T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2023-51580"
    },
    {
      "cve": "CVE-2023-51589",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-51589"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "BlueZ Audio Profile AVRCP parse_media_element Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious device.\n\nThe specific flaw exists within the handling of the AVRCP protocol. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-20853.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 9:bluez-0:5.72-2.el9.x86_64",
          "SUSE Liberty Linux 9:bluez-cups-0:5.72-2.el9.x86_64",
          "SUSE Liberty Linux 9:bluez-libs-0:5.72-2.el9.i686",
          "SUSE Liberty Linux 9:bluez-libs-0:5.72-2.el9.x86_64",
          "SUSE Liberty Linux 9:bluez-libs-devel-0:5.72-2.el9.i686",
          "SUSE Liberty Linux 9:bluez-libs-devel-0:5.72-2.el9.x86_64",
          "SUSE Liberty Linux 9:bluez-obexd-0:5.72-2.el9.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-51589",
          "url": "https://www.suse.com/security/cve/CVE-2023-51589"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1218341 for CVE-2023-51589",
          "url": "https://bugzilla.suse.com/1218341"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 9:bluez-0:5.72-2.el9.x86_64",
            "SUSE Liberty Linux 9:bluez-cups-0:5.72-2.el9.x86_64",
            "SUSE Liberty Linux 9:bluez-libs-0:5.72-2.el9.i686",
            "SUSE Liberty Linux 9:bluez-libs-0:5.72-2.el9.x86_64",
            "SUSE Liberty Linux 9:bluez-libs-devel-0:5.72-2.el9.i686",
            "SUSE Liberty Linux 9:bluez-libs-devel-0:5.72-2.el9.x86_64",
            "SUSE Liberty Linux 9:bluez-obexd-0:5.72-2.el9.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 9:bluez-0:5.72-2.el9.x86_64",
            "SUSE Liberty Linux 9:bluez-cups-0:5.72-2.el9.x86_64",
            "SUSE Liberty Linux 9:bluez-libs-0:5.72-2.el9.i686",
            "SUSE Liberty Linux 9:bluez-libs-0:5.72-2.el9.x86_64",
            "SUSE Liberty Linux 9:bluez-libs-devel-0:5.72-2.el9.i686",
            "SUSE Liberty Linux 9:bluez-libs-devel-0:5.72-2.el9.x86_64",
            "SUSE Liberty Linux 9:bluez-obexd-0:5.72-2.el9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-12T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2023-51589"
    },
    {
      "cve": "CVE-2023-51592",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-51592"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "BlueZ Audio Profile AVRCP parse_media_folder Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious device.\n\nThe specific flaw exists within the handling of the AVRCP protocol. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-20854.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 9:bluez-0:5.72-2.el9.x86_64",
          "SUSE Liberty Linux 9:bluez-cups-0:5.72-2.el9.x86_64",
          "SUSE Liberty Linux 9:bluez-libs-0:5.72-2.el9.i686",
          "SUSE Liberty Linux 9:bluez-libs-0:5.72-2.el9.x86_64",
          "SUSE Liberty Linux 9:bluez-libs-devel-0:5.72-2.el9.i686",
          "SUSE Liberty Linux 9:bluez-libs-devel-0:5.72-2.el9.x86_64",
          "SUSE Liberty Linux 9:bluez-obexd-0:5.72-2.el9.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-51592",
          "url": "https://www.suse.com/security/cve/CVE-2023-51592"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1218340 for CVE-2023-51592",
          "url": "https://bugzilla.suse.com/1218340"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 9:bluez-0:5.72-2.el9.x86_64",
            "SUSE Liberty Linux 9:bluez-cups-0:5.72-2.el9.x86_64",
            "SUSE Liberty Linux 9:bluez-libs-0:5.72-2.el9.i686",
            "SUSE Liberty Linux 9:bluez-libs-0:5.72-2.el9.x86_64",
            "SUSE Liberty Linux 9:bluez-libs-devel-0:5.72-2.el9.i686",
            "SUSE Liberty Linux 9:bluez-libs-devel-0:5.72-2.el9.x86_64",
            "SUSE Liberty Linux 9:bluez-obexd-0:5.72-2.el9.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 9:bluez-0:5.72-2.el9.x86_64",
            "SUSE Liberty Linux 9:bluez-cups-0:5.72-2.el9.x86_64",
            "SUSE Liberty Linux 9:bluez-libs-0:5.72-2.el9.i686",
            "SUSE Liberty Linux 9:bluez-libs-0:5.72-2.el9.x86_64",
            "SUSE Liberty Linux 9:bluez-libs-devel-0:5.72-2.el9.i686",
            "SUSE Liberty Linux 9:bluez-libs-devel-0:5.72-2.el9.x86_64",
            "SUSE Liberty Linux 9:bluez-obexd-0:5.72-2.el9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-12T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2023-51592"
    },
    {
      "cve": "CVE-2023-51594",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-51594"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "BlueZ OBEX Library Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious Bluetooth device.\n\nThe specific flaw exists within the handling of OBEX protocol parameters. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-20937.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 9:bluez-0:5.72-2.el9.x86_64",
          "SUSE Liberty Linux 9:bluez-cups-0:5.72-2.el9.x86_64",
          "SUSE Liberty Linux 9:bluez-libs-0:5.72-2.el9.i686",
          "SUSE Liberty Linux 9:bluez-libs-0:5.72-2.el9.x86_64",
          "SUSE Liberty Linux 9:bluez-libs-devel-0:5.72-2.el9.i686",
          "SUSE Liberty Linux 9:bluez-libs-devel-0:5.72-2.el9.x86_64",
          "SUSE Liberty Linux 9:bluez-obexd-0:5.72-2.el9.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-51594",
          "url": "https://www.suse.com/security/cve/CVE-2023-51594"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1218339 for CVE-2023-51594",
          "url": "https://bugzilla.suse.com/1218339"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 9:bluez-0:5.72-2.el9.x86_64",
            "SUSE Liberty Linux 9:bluez-cups-0:5.72-2.el9.x86_64",
            "SUSE Liberty Linux 9:bluez-libs-0:5.72-2.el9.i686",
            "SUSE Liberty Linux 9:bluez-libs-0:5.72-2.el9.x86_64",
            "SUSE Liberty Linux 9:bluez-libs-devel-0:5.72-2.el9.i686",
            "SUSE Liberty Linux 9:bluez-libs-devel-0:5.72-2.el9.x86_64",
            "SUSE Liberty Linux 9:bluez-obexd-0:5.72-2.el9.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 2.6,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 9:bluez-0:5.72-2.el9.x86_64",
            "SUSE Liberty Linux 9:bluez-cups-0:5.72-2.el9.x86_64",
            "SUSE Liberty Linux 9:bluez-libs-0:5.72-2.el9.i686",
            "SUSE Liberty Linux 9:bluez-libs-0:5.72-2.el9.x86_64",
            "SUSE Liberty Linux 9:bluez-libs-devel-0:5.72-2.el9.i686",
            "SUSE Liberty Linux 9:bluez-libs-devel-0:5.72-2.el9.x86_64",
            "SUSE Liberty Linux 9:bluez-obexd-0:5.72-2.el9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-12T00:00:00Z",
          "details": "low"
        }
      ],
      "title": "CVE-2023-51594"
    },
    {
      "cve": "CVE-2023-51596",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-51596"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "BlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious Bluetooth device.\n\nThe specific flaw exists within the handling of the Phone Book Access profile. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-20939.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 9:bluez-0:5.72-2.el9.x86_64",
          "SUSE Liberty Linux 9:bluez-cups-0:5.72-2.el9.x86_64",
          "SUSE Liberty Linux 9:bluez-libs-0:5.72-2.el9.i686",
          "SUSE Liberty Linux 9:bluez-libs-0:5.72-2.el9.x86_64",
          "SUSE Liberty Linux 9:bluez-libs-devel-0:5.72-2.el9.i686",
          "SUSE Liberty Linux 9:bluez-libs-devel-0:5.72-2.el9.x86_64",
          "SUSE Liberty Linux 9:bluez-obexd-0:5.72-2.el9.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-51596",
          "url": "https://www.suse.com/security/cve/CVE-2023-51596"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1218338 for CVE-2023-51596",
          "url": "https://bugzilla.suse.com/1218338"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 9:bluez-0:5.72-2.el9.x86_64",
            "SUSE Liberty Linux 9:bluez-cups-0:5.72-2.el9.x86_64",
            "SUSE Liberty Linux 9:bluez-libs-0:5.72-2.el9.i686",
            "SUSE Liberty Linux 9:bluez-libs-0:5.72-2.el9.x86_64",
            "SUSE Liberty Linux 9:bluez-libs-devel-0:5.72-2.el9.i686",
            "SUSE Liberty Linux 9:bluez-libs-devel-0:5.72-2.el9.x86_64",
            "SUSE Liberty Linux 9:bluez-obexd-0:5.72-2.el9.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 9:bluez-0:5.72-2.el9.x86_64",
            "SUSE Liberty Linux 9:bluez-cups-0:5.72-2.el9.x86_64",
            "SUSE Liberty Linux 9:bluez-libs-0:5.72-2.el9.i686",
            "SUSE Liberty Linux 9:bluez-libs-0:5.72-2.el9.x86_64",
            "SUSE Liberty Linux 9:bluez-libs-devel-0:5.72-2.el9.i686",
            "SUSE Liberty Linux 9:bluez-libs-devel-0:5.72-2.el9.x86_64",
            "SUSE Liberty Linux 9:bluez-obexd-0:5.72-2.el9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-12T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2023-51596"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.