Every CVE Search/ Get API key

CVE-2016-9918

In BlueZ 5.42, an out-of-bounds read was identified in "packet_hexdump" function in "monitor...

7.5 HighFix available

CVE-2016-9918 is a high vulnerability (CVSS 7.5) in Bluez Project Bluez, published December 8, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.82%, the 90th percentile. Fixed in bluez 5.66-1+deb12u2.root.io.10.

In BlueZ 5.42, an out-of-bounds read was identified in "packet_hexdump" function in "monitor/packet.c" source file. This issue can be triggered by processing a corrupted dump file and will result in btmon crash.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

3.82%Up 2.9 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 7.5

In BlueZ 5.42, an out-of-bounds read was identified in "packet_hexdump" function in "monitor/packet.c" source file. This issue can be triggered by processing a corrupted dump file and will result in btmon crash.

Record
CVE-2016-9918
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-125
Updated
2026-11-02
CVE List No score

In BlueZ 5.42, an out-of-bounds read was identified in "packet_hexdump" function in "monitor/packet.c" source file. This issue can be triggered by processing a corrupted dump file and will result in btmon crash.

Record
CVE-2016-9918
Updated
2026-11-02
EUVDEUVD-2016-10705 No score

In BlueZ 5.42, an out-of-bounds read was identified in "packet_hexdump" function in "monitor/packet.c" source file. This issue can be triggered by processing a corrupted dump file and will result in btmon crash.

Record
EUVD-2016-10705
Updated
2026-11-03
GitHub AdvisoriesGHSA-wv4g-wq9q-gp9j 7.5

In BlueZ 5.42, an out-of-bounds read was identified in "packet_hexdump" function in "monitor...

In BlueZ 5.42, an out-of-bounds read was identified in "packet_hexdump" function in "monitor/packet.c" source file. This issue can be triggered by processing a corrupted dump file and will result in btmon crash.

Record
GHSA-wv4g-wq9q-gp9j
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-125
Updated
2026-11-02
OSV 7.5

In BlueZ 5.42, an out-of-bounds read was identified in "packet_hexdump" function in "monitor/packet.c" source file. This issue can be triggered by processing a corrupted dump file and will result in btmon crash.

Record
CVE-2016-9918
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2016-9918 7.5

In BlueZ 5.42, an out-of-bounds read was identified in "packet_hexdump" function in "monitor/packet.c" source file. This issue can be triggered by processing a corrupted dump file and will result in btmon crash.

Record
DEBIAN-CVE-2016-9918
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 7 moreShow less
OSVUBUNTU-CVE-2016-9918 7.5

In BlueZ 5.42, an out-of-bounds read was identified in "packet_hexdump" function in "monitor/packet.c" source file. This issue can be triggered by processing a corrupted dump file and will result in btmon crash.

Record
UBUNTU-CVE-2016-9918
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVopenSUSE-SU-2019:1198-1 No score

Security update for bluez

This update for bluez fixes the following issues:

Security issue fixed:

  • CVE-2016-9918: Fixed a out-of-bound read in the packet_hexdump function (bsc#1015173)

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2019:1198-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:12446-1 No score

bluez-5.65-4.1 on GA media

These are all security issues fixed in the bluez-5.65-4.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:12446-1
Updated
2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2016-9918 No score

CVE-2016-9918 in bluez - Patched by Root

Root has patched CVE-2016-9918 in the bluez package for Root:Debian:12. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-12-CVE-2016-9918
Updated
2026-11-02
OSVSUSE-SU-2019:0510-1 No score

Security update for bluez

This update for bluez fixes the following issues:

Security issues fixed:

  • CVE-2016-7837: Fixed possible buffer overflow, make sure we don't write past the end of the array.(bsc#1026652)
  • CVE-2016-9800: Fix hcidump memory leak in pin_code_reply_dump() (bsc#1013721).
  • CVE-2016-9801: Fixed a buffer overflow in set_ext_ctrl function (bsc#1013732)
  • CVE-2016-9804: Fix hcidump buffer overflow in commands_dump() (bsc#1013877).
  • CVE-2016-9918: Fixed an out-of-bounds read in packet_hexdump() (bsc#1015173)
  • CVE-2017-1000250: Fixed a information leak in SDP (part of the recently published BlueBorne vulnerabilities) (bsc#1057342)
Record
SUSE-SU-2019:0510-1
Updated
2026-11-02
OSVSUSE-SU-2019:0841-1 No score

Security update for bluez

This update for bluez fixes the following issues:

Security issue fixed:

  • CVE-2016-9918: Fixed a out-of-bound read in the packet_hexdump function (bsc#1015173)
Record
SUSE-SU-2019:0841-1
Updated
2026-11-02
OSVSUSE-SU-2019:1339-1 No score

Security update for bluez

This update for bluez fixes the following issues:

Security vulnerability addressed:

  • CVE-2016-9797: Fixed a buffer over-read in l2cap_dump() (bsc#1013708).
  • CVE-2016-9798: Fixed a use-after-free in conf_opt() (bsc#1013712).
  • CVE-2016-9917: Fixed a heap-based buffer overflow in read_n() (bsc#1015171).
  • CVE-2016-9802: Fixed a buffer over-read in l2cap_packet() (bsc#1013893).
  • CVE-2016-9918: Fixed an out-of-bounds stack read in packet_hexdump(), which could be triggered by processing a corrupted dump file and will result in a crash of the hcidump tool (bsc#1015173)
Record
SUSE-SU-2019:1339-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
bluez
Debian:12
 All versions, plus listed versions
5.66-15.66-1+deb12u15.66-1+deb12u25.68-15.68-2
Show 22 moreShow less
5.69-15.70-15.70-1.15.70-1.1~exp05.71-15.73-15.73-1.15.77-15.79-15.79-25.82-15.82-1.15.83-15.83-1~exp15.84-15.85-15.85-25.85-35.85-45.87-15.87-25.87-3
 None known
bluez
Debian:13
 All versions, plus listed versions
5.82-1.15.83-15.83-1~exp15.84-15.85-1
Show 6 moreShow less
5.85-25.85-35.85-45.87-15.87-25.87-3
 None known
bluez
Debian:14
 All versions, plus listed versions
5.82-1.15.83-15.83-1~exp15.84-15.85-1
Show 6 moreShow less
5.85-25.85-35.85-45.87-15.87-25.87-3
 None known
bluez
Root:Debian:12
 before 5.66-1+deb12u2.root.io.10
5.66-1+deb12u2.root.io.105.66-1+deb12u2.root.io.15.66-1+deb12u2.root.io.35.66-1+deb12u2.root.io.145.66-1+deb12u2.root.io.65.66-1+deb12u2.root.io.165.66-1+deb12u2.root.io.25.66-1+deb12u2.root.io.45.66-1+deb12u2.root.io.55.66-1+deb12u2.root.io.75.66-1+deb12u2.root.io.85.66-1+deb12u2.root.io.95.66-1+deb12u2.root.io.135.66-1+deb12u2.root.io.115.66-1+deb12u2.root.io.125.66-1+deb12u2.root.io.155.66-1+deb12u2.aikido.175.66-1+deb12u2.aikido.185.66-1+deb12u2.aikido.19
rootio-bluez
Root:Debian:12
 before 5.66-1+deb12u2.root.io.10
5.66-1+deb12u2.root.io.105.66-1+deb12u2.root.io.15.66-1+deb12u2.root.io.35.66-1+deb12u2.root.io.145.66-1+deb12u2.root.io.65.66-1+deb12u2.root.io.165.66-1+deb12u2.root.io.25.66-1+deb12u2.root.io.45.66-1+deb12u2.root.io.55.66-1+deb12u2.root.io.75.66-1+deb12u2.root.io.85.66-1+deb12u2.root.io.95.66-1+deb12u2.root.io.135.66-1+deb12u2.root.io.115.66-1+deb12u2.root.io.125.66-1+deb12u2.root.io.155.66-1+deb12u2.aikido.175.66-1+deb12u2.aikido.185.66-1+deb12u2.aikido.19
bluez
SUSE:Linux Enterprise Server for SAP Applications 12 SP1
 before 5.13-3.10.1
5.13-3.10.1
bluez
SUSE:Linux Enterprise Server 12-LTSS
 before 5.13-3.10.1
5.13-3.10.1
bluez
SUSE:Linux Enterprise Server 12 SP1-LTSS
 before 5.13-3.10.1
5.13-3.10.1
bluez
SUSE:Linux Enterprise Module for Basesystem 15
 before 5.48-5.13.10
5.48-5.13.10
bluez
SUSE:Linux Enterprise Module for Desktop Applications 15
 before 5.48-5.13.10
5.48-5.13.10
Show 21 moreShow less
Affected packages
PackageAffectedFixed
bluez
SUSE:Linux Enterprise Workstation Extension 15
 before 5.48-5.13.10
5.48-5.13.10
bluez
SUSE:Linux Enterprise Desktop 12 SP3
 before 5.13-5.12.1
5.13-5.12.1
bluez
SUSE:Linux Enterprise Desktop 12 SP4
 before 5.13-5.12.1
5.13-5.12.1
bluez
SUSE:Linux Enterprise Software Development Kit 12 SP3
 before 5.13-5.12.1
5.13-5.12.1
bluez
SUSE:Linux Enterprise Software Development Kit 12 SP4
 before 5.13-5.12.1
5.13-5.12.1
bluez
SUSE:Linux Enterprise Server 12 SP3
 before 5.13-5.12.1
5.13-5.12.1
bluez
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
 before 5.13-5.12.1
5.13-5.12.1
bluez
SUSE:Linux Enterprise Server 12 SP4
 before 5.13-5.12.1
5.13-5.12.1
bluez
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
 before 5.13-5.12.1
5.13-5.12.1
bluez
SUSE:Linux Enterprise Workstation Extension 12 SP3
 before 5.13-5.12.1
5.13-5.12.1
bluez
SUSE:Linux Enterprise Workstation Extension 12 SP4
 before 5.13-5.12.1
5.13-5.12.1
bluez
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
5.35-0ubuntu25.36-0ubuntu15.37-0ubuntu55.37-0ubuntu5.15.37-0ubuntu5.3
Show 6 moreShow less
5.37-0ubuntu5.3+esm15.37-0ubuntu5.3+esm25.37-0ubuntu5.3+esm35.37-0ubuntu5.3+esm45.37-0ubuntu5.3+esm55.37-0ubuntu5.3+esm6
 None known
bluez
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
5.46-0ubuntu35.46-0ubuntu45.48-0ubuntu35.48-0ubuntu3.15.48-0ubuntu3.2
Show 10 moreShow less
5.48-0ubuntu3.35.48-0ubuntu3.45.48-0ubuntu3.55.48-0ubuntu3.65.48-0ubuntu3.75.48-0ubuntu3.85.48-0ubuntu3.95.48-0ubuntu3.9+esm15.48-0ubuntu3.9+esm25.48-0ubuntu3.9+esm3
 None known
bluez
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
5.50-0ubuntu45.51-0ubuntu15.51-0ubuntu25.52-0ubuntu15.52-0ubuntu2
Show 14 moreShow less
5.53-0ubuntu15.53-0ubuntu25.53-0ubuntu35.53-0ubuntu3.15.53-0ubuntu3.25.53-0ubuntu3.35.53-0ubuntu3.45.53-0ubuntu3.55.53-0ubuntu3.65.53-0ubuntu3.75.53-0ubuntu3.85.53-0ubuntu3.95.53-0ubuntu3.9+esm15.53-0ubuntu3.9+esm2
 None known
bluez
Ubuntu:22.04:LTS
 All versions, plus listed versions
5.60-0ubuntu25.62-0ubuntu15.62-0ubuntu25.63-0ubuntu15.63-0ubuntu2
Show 6 moreShow less
5.64-0ubuntu15.64-0ubuntu1.15.64-0ubuntu1.35.64-0ubuntu1.45.64-0ubuntu1.55.64-0ubuntu1.6
 None known
bluez
Ubuntu:24.04:LTS
 All versions, plus listed versions
5.68-0ubuntu15.70-0ubuntu15.70-0ubuntu25.70-0ubuntu35.71-0ubuntu3
Show 13 moreShow less
5.71-1ubuntu25.71-1ubuntu35.72-0ubuntu15.72-0ubuntu35.72-0ubuntu45.72-0ubuntu55.72-0ubuntu5.15.72-0ubuntu5.35.72-0ubuntu5.45.72-0ubuntu5.55.72-0ubuntu5.65.72-0ubuntu5.75.72-0ubuntu5.8
 None known
bluez
Ubuntu:25.10
 All versions, plus listed versions
5.79-2ubuntu15.82-15.82-1ubuntu15.83-1~exp15.83-1~exp1ubuntu0.1
 None known
bluez
Ubuntu:26.10
 All versions, plus listed versions
5.85-45.85-4ubuntu15.87-15.87-25.87-35.87-4
 None known
bluez
Ubuntu:26.04:LTS
 All versions, plus listed versions
5.83-1~exp15.84-15.85-15.85-25.85-3
Show 5 moreShow less
5.85-45.85-4ubuntu0.15.85-4ubuntu0.25.85-4ubuntu0.35.85-4ubuntu0.4
 None known
bluez
openSUSE:Leap 15.0
 before 5.48-lp150.4.10.1
5.48-lp150.4.10.1
bluez
openSUSE:Tumbleweed
 before 5.65-4.1
5.65-4.1

History

History
WhenChangedSources
2026-11-03aliasesEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV

References

Show 28 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open