CVE-2022-39176
BlueZ before 5.59 allows physically proximate attackers to obtain sensitive information because...
BlueZ before 5.59 allows physically proximate attackers to obtain sensitive information because profiles/audio/avrcp.c does not validate params_len.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
BlueZ before 5.59 allows physically proximate attackers to obtain sensitive information because profiles/audio/avrcp.c does not validate params_len.
- Record
CVE-2022-39176- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
CVE List
BlueZ before 5.59 allows physically proximate attackers to obtain sensitive information because profiles/audio/avrcp.c does not validate params_len.
- Record
CVE-2022-39176- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
EUVDEUVD-2022-41721
BlueZ before 5.59 allows physically proximate attackers to obtain sensitive information because profiles/audio/avrcp.c does not validate params_len.
- Record
EUVD-2022-41721- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-4hw3-29f2-2c2f
BlueZ before 5.59 allows physically proximate attackers to obtain sensitive information because...
BlueZ before 5.59 allows physically proximate attackers to obtain sensitive information because profiles/audio/avrcp.c does not validate params_len.
- Record
GHSA-4hw3-29f2-2c2f- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSV
BlueZ before 5.59 allows physically proximate attackers to obtain sensitive information because profiles/audio/avrcp.c does not validate params_len.
- Record
CVE-2022-39176- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2022-1922
bluez security update
This package provides all utilities for use in Bluetooth applications. The BLUETOOTH trademarks are owned by Bluetooth SIG, Inc., U.S.A.
Security Fix(es):
BlueZ before 5.59 allows physically proximate attackers to cause a denial of service because malformed and invalid capabilities can be processed in profiles/audio/avdtp.c.(CVE-2022-39177)
BlueZ before 5.59 allows physically proximate attackers to obtain sensitive information because profiles/audio/avrcp.c does not validate params_len.(CVE-2022-39176)
- Record
OESA-2022-1922- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 7 moreShow less
OSVUBUNTU-CVE-2022-39176
BlueZ before 5.59 allows physically proximate attackers to obtain sensitive information because profiles/audio/avrcp.c does not validate params_len.
- Record
UBUNTU-CVE-2022-39176- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVCLSA-2026-1777541445 No score
bluez: Fix of 3 CVEs
- CVE-2022-0204: fix heap overflow when appending prepare writes in gatt-server
- CVE-2022-39176: fix not checking params_len in AVRCP vendordep PDU handling
- CVE-2022-39177: fix accepting invalid/malformed capabilities in AVDTP
- Record
CLSA-2026-1777541445- Updated
- 2026-11-02
OSVDEBIAN-CVE-2022-39176 No score
BlueZ before 5.59 allows physically proximate attackers to obtain sensitive information because profiles/audio/avrcp.c does not validate params_len.
- Record
DEBIAN-CVE-2022-39176- Updated
- 2026-11-03
OSVSUSE-SU-2023:0155-1 No score
Security update for bluez
This update for bluez fixes the following issues:
- CVE-2022-39176: Fixed a memory safety issue that could allow physically proximate attackers to obtain sensitive information (bsc#1203121).
- CVE-2022-39177: Fixed a memory safety issue that could allow physically proximate attackers to cause a denial of service (bsc#1203120).
- Record
SUSE-SU-2023:0155-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:0156-1 No score
Security update for bluez
This update for bluez fixes the following issues:
- CVE-2022-39176: Fixed a memory safety issue that could allow physically proximate attackers to obtain sensitive information (bsc#1203121).
- CVE-2022-39177: Fixed a memory safety issue that could allow physically proximate attackers to cause a denial of service (bsc#1203120).
- Record
SUSE-SU-2023:0156-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:0166-1 No score
Security update for bluez
This update for bluez fixes the following issues:
- CVE-2022-39176: Fixed a memory safety issue that could allow physically proximate attackers to obtain sensitive information (bsc#1203121).
- CVE-2022-39177: Fixed a memory safety issue that could allow physically proximate attackers to cause a denial of service (bsc#1203120).
- Record
SUSE-SU-2023:0166-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:0168-1 No score
Security update for bluez
This update for bluez fixes the following issues:
- CVE-2022-39176: Fixed a memory safety issue that could allow physically proximate attackers to obtain sensitive information (bsc#1203121).
- CVE-2022-39177: Fixed a memory safety issue that could allow physically proximate attackers to cause a denial of service (bsc#1203120).
- Record
SUSE-SU-2023:0168-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
bluezTuxCare:CentOS:7 From an advisory covering 3 CVEs |
before 5.44-7.el7.tuxcare.els1 | 5.44-7.el7.tuxcare.els1 |
bluez-cupsTuxCare:CentOS:7 From an advisory covering 3 CVEs |
before 5.44-7.el7.tuxcare.els1 | 5.44-7.el7.tuxcare.els1 |
bluez-hid2hciTuxCare:CentOS:7 From an advisory covering 3 CVEs |
before 5.44-7.el7.tuxcare.els1 | 5.44-7.el7.tuxcare.els1 |
bluez-libsTuxCare:CentOS:7 From an advisory covering 3 CVEs |
before 5.44-7.el7.tuxcare.els1 | 5.44-7.el7.tuxcare.els1 |
bluez-libs-develTuxCare:CentOS:7 From an advisory covering 3 CVEs |
before 5.44-7.el7.tuxcare.els1 | 5.44-7.el7.tuxcare.els1 |
bluezDebian:12 |
before 5.61-1 | 5.61-1 |
bluezDebian:13 |
before 5.61-1 | 5.61-1 |
bluezDebian:14 |
before 5.61-1 | 5.61-1 |
bluezDebian:10 From an advisory covering 7 CVEs |
before 5.50-1.2~deb10u3, plus listed versions 5.50-15.50-1.15.50-1.2~deb10u15.50-1.2~deb10u2 |
5.50-1.2~deb10u3 |
bluezDebian:11 From an advisory covering 9 CVEs |
before 5.55-3.1+deb11u2, plus listed versions 5.55-3.15.55-3.1+deb11u1 |
5.55-3.1+deb11u2 |
Show 32 moreShow less
| Package | Affected | Fixed |
|---|---|---|
bluezopenEuler:20.03-LTS-SP1 From an advisory covering 2 CVEs |
before 5.54-11.oe1 | 5.54-11.oe1 |
bluezopenEuler:20.03-LTS-SP3 From an advisory covering 2 CVEs |
before 5.54-11.oe1 | 5.54-11.oe1 |
bluezopenEuler:22.03-LTS From an advisory covering 2 CVEs |
before 5.54-15.oe2203 | 5.54-15.oe2203 |
bluezSUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS From an advisory covering 2 CVEs |
before 5.48-150000.5.46.1 | 5.48-150000.5.46.1 |
bluezSUSE:Linux Enterprise Server 15 SP1-LTSS From an advisory covering 2 CVEs |
before 5.48-150000.5.46.1 | 5.48-150000.5.46.1 |
bluezSUSE:Linux Enterprise Server for SAP Applications 15 SP1 From an advisory covering 2 CVEs |
before 5.48-150000.5.46.1 | 5.48-150000.5.46.1 |
bluezSUSE:Enterprise Storage 6 From an advisory covering 2 CVEs |
before 5.48-150000.5.46.1 | 5.48-150000.5.46.1 |
bluezSUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS From an advisory covering 2 CVEs |
before 5.48-150200.13.22.1 | 5.48-150200.13.22.1 |
bluezSUSE:Linux Enterprise Server 15 SP2-LTSS From an advisory covering 2 CVEs |
before 5.48-150200.13.22.1 | 5.48-150200.13.22.1 |
bluezSUSE:Linux Enterprise Server for SAP Applications 15 SP2 From an advisory covering 2 CVEs |
before 5.48-150200.13.22.1 | 5.48-150200.13.22.1 |
bluezSUSE:Enterprise Storage 7 From an advisory covering 2 CVEs |
before 5.48-150200.13.22.1 | 5.48-150200.13.22.1 |
bluezSUSE:OpenStack Cloud 9 From an advisory covering 2 CVEs |
before 5.13-5.36.1 | 5.13-5.36.1 |
bluezSUSE:OpenStack Cloud Crowbar 9 From an advisory covering 2 CVEs |
before 5.13-5.36.1 | 5.13-5.36.1 |
bluezSUSE:Linux Enterprise Server for SAP Applications 12 SP4 From an advisory covering 2 CVEs |
before 5.13-5.36.1 | 5.13-5.36.1 |
bluezSUSE:Linux Enterprise Software Development Kit 12 SP5 From an advisory covering 2 CVEs |
before 5.13-5.36.1 | 5.13-5.36.1 |
bluezSUSE:Linux Enterprise Server 12 SP2-BCL From an advisory covering 2 CVEs |
before 5.13-5.36.1 | 5.13-5.36.1 |
bluezSUSE:Linux Enterprise Server 12 SP4-LTSS From an advisory covering 2 CVEs |
before 5.13-5.36.1 | 5.13-5.36.1 |
bluezSUSE:Linux Enterprise Server 12 SP5 From an advisory covering 2 CVEs |
before 5.13-5.36.1 | 5.13-5.36.1 |
bluezSUSE:Linux Enterprise Server for SAP Applications 12 SP5 From an advisory covering 2 CVEs |
before 5.13-5.36.1 | 5.13-5.36.1 |
bluezSUSE:Linux Enterprise Workstation Extension 12 SP5 From an advisory covering 2 CVEs |
before 5.13-5.36.1 | 5.13-5.36.1 |
bluezSUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS From an advisory covering 2 CVEs |
before 5.55-150300.3.19.1 | 5.55-150300.3.19.1 |
bluezSUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS From an advisory covering 2 CVEs |
before 5.55-150300.3.19.1 | 5.55-150300.3.19.1 |
bluezSUSE:Linux Enterprise Real Time 15 SP3 From an advisory covering 2 CVEs |
before 5.55-150300.3.19.1 | 5.55-150300.3.19.1 |
bluezSUSE:Linux Enterprise Server 15 SP3-LTSS From an advisory covering 2 CVEs |
before 5.55-150300.3.19.1 | 5.55-150300.3.19.1 |
bluezSUSE:Linux Enterprise Server for SAP Applications 15 SP3 From an advisory covering 2 CVEs |
before 5.55-150300.3.19.1 | 5.55-150300.3.19.1 |
bluezSUSE:Manager Proxy 4.2 From an advisory covering 2 CVEs |
before 5.55-150300.3.19.1 | 5.55-150300.3.19.1 |
bluezSUSE:Manager Retail Branch Server 4.2 From an advisory covering 2 CVEs |
before 5.55-150300.3.19.1 | 5.55-150300.3.19.1 |
bluezSUSE:Manager Server 4.2 From an advisory covering 2 CVEs |
before 5.55-150300.3.19.1 | 5.55-150300.3.19.1 |
bluezSUSE:Enterprise Storage 7.1 From an advisory covering 2 CVEs |
before 5.55-150300.3.19.1 | 5.55-150300.3.19.1 |
bluezUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 5.35-0ubuntu25.36-0ubuntu15.37-0ubuntu55.37-0ubuntu5.15.37-0ubuntu5.3 Show 6 moreShow less5.37-0ubuntu5.3+esm15.37-0ubuntu5.3+esm25.37-0ubuntu5.3+esm35.37-0ubuntu5.3+esm45.37-0ubuntu5.3+esm55.37-0ubuntu5.3+esm6 |
None known |
bluezUbuntu:18.04:LTS |
before 5.48-0ubuntu3.9, plus listed versions 5.46-0ubuntu35.46-0ubuntu45.48-0ubuntu35.48-0ubuntu3.15.48-0ubuntu3.2 Show 6 moreShow less5.48-0ubuntu3.35.48-0ubuntu3.45.48-0ubuntu3.55.48-0ubuntu3.65.48-0ubuntu3.75.48-0ubuntu3.8 |
5.48-0ubuntu3.9 |
bluezUbuntu:20.04:LTS |
before 5.53-0ubuntu3.6, plus listed versions 5.50-0ubuntu45.51-0ubuntu15.51-0ubuntu25.52-0ubuntu15.52-0ubuntu2 Show 8 moreShow less5.53-0ubuntu15.53-0ubuntu25.53-0ubuntu35.53-0ubuntu3.15.53-0ubuntu3.25.53-0ubuntu3.35.53-0ubuntu3.45.53-0ubuntu3.5 |
5.53-0ubuntu3.6 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-39176 is a high vulnerability (CVSS 8.8) in Bluez, published September 2, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.75%, the 55th percentile. Fixed in bluez 5.61-1.
References
ubuntu.com/security/notices/USN-5481-1
bugs.launchpad.net/ubuntu/+source/bluez/+bug/1977968
security.netapp.com/advisory/ntap-20221020-0002
lists.debian.org/debian-lts-announce/2022/10/msg00026.html
nvd.nist.gov/vuln/detail/CVE-2022-39176
Show 16 moreShow less
github.com/advisories/GHSA-4hw3-29f2-2c2f
errata.tuxcare.com/els_os/centos7els/CLSA-2026-1777541445.html
security-tracker.debian.org/tracker/CVE-2022-39176
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1922
suse.com/support/update/announcement/2023/suse-su-20230155-1
bugzilla.suse.com/1203120
cve.org/CVERecord?id=CVE-2022-39176