Every CVE Search/ Get API key

CVE-2023-27349

BlueZ Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability

7.1 HighFix available

BlueZ Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious device.

The specific flaw exists within the handling of the AVRCP protocol. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-19908.

Attack profile

How easy it is to exploit

Attack vector
Adjacent network
Complexity
High
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

1.43%Up 1.4 points since May 3, 2024
90%50%10%1%

What each source reports

CVE List Score used 7.1

BlueZ Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability

BlueZ Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious device.

The specific flaw exists within the handling of the AVRCP protocol. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-19908.

Record
CVE-2023-27349
CVSS 3.0
7.1 HighCVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-129
Updated
2026-11-02
EUVDEUVD-2023-31125 7.1

BlueZ Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious device.

The specific flaw exists within the handling of the AVRCP protocol. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-19908.

Record
EUVD-2023-31125
CVSS 3.0
7.1 HighCVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-r3vg-5hjq-528v 7.1

BlueZ Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability....

BlueZ Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious device.

The specific flaw exists within the handling of the AVRCP protocol. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-19908.

Record
GHSA-r3vg-5hjq-528v
CVSS 3.0
7.1 HighCVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-129
Updated
2026-11-02
NVD 8.0

BlueZ Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious device.

The specific flaw exists within the handling of the AVRCP protocol. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-19908.

Record
CVE-2023-27349
CVSS 3.1
8.0 HighCVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 3.0
7.1 HighCVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-129
Updated
2026-11-02
OSV 7.1

BlueZ Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability

BlueZ Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious device.

The specific flaw exists within the handling of the AVRCP protocol. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-19908.

Record
CVE-2023-27349
CVSS 3.0
7.1 HighCVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-129
Updated
2026-11-02
OSVDEBIAN-CVE-2023-27349 8.0

BlueZ Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious device. The specific flaw exists within the handling of the AVRCP protocol. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-19908.

Record
DEBIAN-CVE-2023-27349
CVSS 3.1
8.0 HighCVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 19 moreShow less
OSVOESA-2023-1249 8.0

bluez security update

This package provides all utilities for use in Bluetooth applications. The BLUETOOTH trademarks are owned by Bluetooth SIG, Inc., U.S.A.

Security Fix(es):

(CVE-2023-27349)

Record
OESA-2023-1249
CVSS 3.1
8.0 HighCVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2024:9413 7.1

Red Hat Security Advisory: bluez security update

Record
RHSA-2024:9413
CVSS 3.1
7.1 HighCVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2025:4043 7.1

Red Hat Security Advisory: bluez security update

Record
RHSA-2025:4043
CVSS 3.0
7.1 HighCVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2025:4043 7.1

Moderate: bluez security update

The bluez packages contain the following utilities for use in Bluetooth applications: hcitool, hciattach, hciconfig, bluetoothd, l2ping, start scripts (Rocky Enterprise Software Foundation), and pcmcia configuration files.

Security Fix(es):

  • BlueZ: Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability (CVE-2023-27349)

  • bluez: audio profile avrcp parse_media_element out-of-bounds read information disclosure vulnerability (CVE-2023-51589)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2025:4043
CVSS 3.0
7.1 HighCVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2023-27349 8.0

BlueZ Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious device. The specific flaw exists within the handling of the AVRCP protocol. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-19908.

Record
UBUNTU-CVE-2023-27349
CVSS 3.1
8.0 HighCVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 3.0
7.1 HighCVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVALSA-2024:9413 No score

Moderate: bluez security update

The bluez packages contain the following utilities for use in Bluetooth applications: hcitool, hciattach, hciconfig, bluetoothd, l2ping, start scripts (AlmaLinux), and pcmcia configuration files.

Security Fix(es):

  • bluez: unauthorized HID device connections allows keystroke injection and arbitrary commands execution (CVE-2023-45866)
  • BlueZ: Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability (CVE-2023-27349)
  • bluez: phone book access profile heap-based buffer overflow remote code execution vulnerability (CVE-2023-51596)
  • bluez: OBEX library out-of-bounds read information disclosure vulnerability (CVE-2023-51594)
  • bluez: audio profile avrcp parse_media_folder out-of-bounds read information disclosure vulnerability (CVE-2023-51592)
  • bluez: audio profile avrcp parse_media_element out-of-bounds read information disclosure vulnerability (CVE-2023-51589)
  • bluez: avrcp_parse_attribute_list out-of-bounds read information disclosure vulnerability (CVE-2023-51580)
  • bluez: AVRCP stack-based buffer overflow remote code execution vulnerability (CVE-2023-44431)
  • bluez: phone book access profile heap-based buffer overflow remote code execution vulnerability (CVE-2023-50230)
  • bluez: phone book access profile heap-based buffer overflow remote code execution vulnerability (CVE-2023-50229)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Record
ALSA-2024:9413
Updated
2026-11-02
OSVALSA-2025:4043 No score

Moderate: bluez security update

The bluez packages contain the following utilities for use in Bluetooth applications: hcitool, hciattach, hciconfig, bluetoothd, l2ping, start scripts (AlmaLinux), and pcmcia configuration files.

Security Fix(es):

  • BlueZ: Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability (CVE-2023-27349)
  • bluez: audio profile avrcp parse_media_element out-of-bounds read information disclosure vulnerability (CVE-2023-51589)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2025:4043
Updated
2026-11-02
OSVCLSA-2025-1754939879 No score

bluez: Fix of CVE-2023-27349

  • CVE-2023-27349: fix crash while handling unsupported events in avrcp
Record
CLSA-2025-1754939879
Updated
2026-11-02
OSVCLSA-2025-1763031616 No score

bluez: Fix of 10 CVEs

  • CVE-2023-27349: fix crash while handling unsupported events in avrcp
  • CVE-2023-44431: fix Stack-based buffer overflow and remote code execution vulnerability
  • CVE-2023-45866: restrict HID connections to avoid unauthorized input injection
  • CVE-2023-50229: fix heap-based buffer overflow vulnerability in handling Phone Book Access profile by adding proper validation of user-supplied data length before copying to buffer
  • CVE-2023-50230: fix heap-based buffer overflow vulnerability in Phone Book Access profile to prevent arbitrary code execution by validating user-supplied data length before copying to buffer
  • CVE-2023-51580: validate AVRCP attribute list data to prevent out-of-bounds reads and information disclosure
  • CVE-2023-51589: validate AVRCP media element data to prevent out-of-bounds reads and information disclosure
  • CVE-2023-51592: validate AVRCP media folder data to prevent out-of-bounds reads and information disclosure
  • CVE-2023-51594: validate OBEX protocol parameters to prevent out-of-bounds reads and information disclosure
  • CVE-2023-51596: validate PBAP data length to prevent heap overflow and remote code execution
Record
CLSA-2025-1763031616
Updated
2026-11-02
OSVCLSA-2026-1788176031 No score

Fix CVE(s): CVE-2023-27349

  • SECURITY UPDATE: out-of-bounds write via an unsupported AVRCP event
    • debian/patches/CVE-2023-27349.patch: reject an event id above AVRCP_EVENT_LAST in avrcp_handle_event() before it is used to index session->transaction_events, a 14-entry array (upstream f54299a850).
    • CVE-2023-27349
Record
CLSA-2026-1788176031
Updated
2026-11-02
OSVopenSUSE-SU-2024:13128-1 No score

bluez-5.68-2.1 on GA media

These are all security issues fixed in the bluez-5.68-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:13128-1
Updated
2026-11-02
OSVRLSA-2024:9413 No score

Moderate: bluez security update

The bluez packages contain the following utilities for use in Bluetooth applications: hcitool, hciattach, hciconfig, bluetoothd, l2ping, start scripts (Rocky Enterprise Software Foundation), and pcmcia configuration files.

Security Fix(es):

  • bluez: unauthorized HID device connections allows keystroke injection and arbitrary commands execution (CVE-2023-45866)

  • BlueZ: Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability (CVE-2023-27349)

  • bluez: phone book access profile heap-based buffer overflow remote code execution vulnerability (CVE-2023-51596)

  • bluez: OBEX library out-of-bounds read information disclosure vulnerability (CVE-2023-51594)

  • bluez: audio profile avrcp parse_media_folder out-of-bounds read information disclosure vulnerability (CVE-2023-51592)

  • bluez: audio profile avrcp parse_media_element out-of-bounds read information disclosure vulnerability (CVE-2023-51589)

  • bluez: avrcp_parse_attribute_list out-of-bounds read information disclosure vulnerability (CVE-2023-51580)

  • bluez: AVRCP stack-based buffer overflow remote code execution vulnerability (CVE-2023-44431)

  • bluez: phone book access profile heap-based buffer overflow remote code execution vulnerability (CVE-2023-50230)

  • bluez: phone book access profile heap-based buffer overflow remote code execution vulnerability (CVE-2023-50229)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 9.5 Release Notes linked from the References section.

Record
RLSA-2024:9413
Updated
2026-11-02
OSVSUSE-SU-2023:2533-1 No score

Security update for bluez

This update for bluez fixes the following issues:

  • CVE-2023-27349: Fixed crash while handling unsupported events (bsc#1210398).
Record
SUSE-SU-2023:2533-1
Updated
2026-11-02
OSVSUSE-SU-2023:2545-1 No score

Security update for bluez

This update for bluez fixes the following issues:

  • CVE-2023-27349: Fixed crash while handling unsupported events (bsc#1210398).
Record
SUSE-SU-2023:2545-1
Updated
2026-11-02
OSVSUSE-SU-2023:2546-1 No score

Security update for bluez

This update for bluez fixes the following issues:

  • CVE-2023-27349: Fixed crash while handling unsupported events (bsc#1210398).
Record
SUSE-SU-2023:2546-1
Updated
2026-11-02
OSVSUSE-SU-2023:2562-1 No score

Security update for bluez

This update for bluez fixes the following issues:

  • CVE-2023-27349: Fixed crash while handling unsupported events (bsc#1210398).
Record
SUSE-SU-2023:2562-1
Updated
2026-11-02
OSVSUSE-SU-2023:2605-1 No score

Security update for bluez

This update for bluez fixes the following issues:

  • CVE-2023-27349: Fixed crash while handling unsupported events (bsc#1210398).
Record
SUSE-SU-2023:2605-1
Updated
2026-11-02
OSVSUSE-SU-2023:2613-1 No score

Security update for bluez

This update for bluez fixes the following issues:

  • CVE-2023-27349: Fixed crash while handling unsupported events (bsc#1210398).
Record
SUSE-SU-2023:2613-1
Updated
2026-11-02
OSVUSN-6809-1 No score

bluez vulnerabilities

It was discovered that BlueZ could be made to dereference invalid memory. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-3563)

It was discovered that BlueZ could be made to write out of bounds. If a user were tricked into connecting to a malicious device, an attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2023-27349)

Record
USN-6809-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
bluez
AlmaLinux:9
From an advisory covering 10 CVEs
 before 5.72-2.el9
5.72-2.el9
bluez-cups
AlmaLinux:9
From an advisory covering 10 CVEs
 before 5.72-2.el9
5.72-2.el9
bluez-libs
AlmaLinux:9
From an advisory covering 10 CVEs
 before 5.72-2.el9
5.72-2.el9
bluez-libs-devel
AlmaLinux:9
From an advisory covering 10 CVEs
 before 5.72-2.el9
5.72-2.el9
bluez-obexd
AlmaLinux:9
From an advisory covering 10 CVEs
 before 5.72-2.el9
5.72-2.el9
bluez-cups
AlmaLinux:8
From an advisory covering 2 CVEs
 before 5.63-5.el8_10.alma.1
5.63-5.el8_10.alma.1
bluez-libs-devel
AlmaLinux:8
From an advisory covering 2 CVEs
 before 5.63-5.el8_10.alma.1
5.63-5.el8_10.alma.1
bluez
TuxCare:AlmaLinux:9.2
 before 5.64-2.el9.tuxcare.els1
5.64-2.el9.tuxcare.els1
bluez-cups
TuxCare:AlmaLinux:9.2
 before 5.64-2.el9.tuxcare.els1
5.64-2.el9.tuxcare.els1
bluez-hid2hci
TuxCare:AlmaLinux:9.2
 before 5.64-2.el9.tuxcare.els1
5.64-2.el9.tuxcare.els1
Show 128 moreShow less
Affected packages
PackageAffectedFixed
bluez-libs
TuxCare:AlmaLinux:9.2
 before 5.64-2.el9.tuxcare.els1
5.64-2.el9.tuxcare.els1
bluez-libs-devel
TuxCare:AlmaLinux:9.2
 before 5.64-2.el9.tuxcare.els1
5.64-2.el9.tuxcare.els1
bluez-mesh
TuxCare:AlmaLinux:9.2
 before 5.64-2.el9.tuxcare.els1
5.64-2.el9.tuxcare.els1
bluez-obexd
TuxCare:AlmaLinux:9.2
 before 5.64-2.el9.tuxcare.els1
5.64-2.el9.tuxcare.els1
bluez
TuxCare:AlmaLinux:9.2
From an advisory covering 10 CVEs
 before 5.72-4.el9.tuxcare.els1
5.72-4.el9.tuxcare.els1
bluez-cups
TuxCare:AlmaLinux:9.2
From an advisory covering 10 CVEs
 before 5.72-4.el9.tuxcare.els1
5.72-4.el9.tuxcare.els1
bluez-hid2hci
TuxCare:AlmaLinux:9.2
From an advisory covering 10 CVEs
 before 5.72-4.el9.tuxcare.els1
5.72-4.el9.tuxcare.els1
bluez-libs
TuxCare:AlmaLinux:9.2
From an advisory covering 10 CVEs
 before 5.72-4.el9.tuxcare.els1
5.72-4.el9.tuxcare.els1
bluez-libs-devel
TuxCare:AlmaLinux:9.2
From an advisory covering 10 CVEs
 before 5.72-4.el9.tuxcare.els1
5.72-4.el9.tuxcare.els1
bluez-mesh
TuxCare:AlmaLinux:9.2
From an advisory covering 10 CVEs
 before 5.72-4.el9.tuxcare.els1
5.72-4.el9.tuxcare.els1
bluez-obexd
TuxCare:AlmaLinux:9.2
From an advisory covering 10 CVEs
 before 5.72-4.el9.tuxcare.els1
5.72-4.el9.tuxcare.els1
bluetooth
TuxCare:Ubuntu:18.04
 before 5.48-0ubuntu3.9+tuxcare.els1
5.48-0ubuntu3.9+tuxcare.els1
bluez
TuxCare:Ubuntu:18.04
 before 5.48-0ubuntu3.9+tuxcare.els1
5.48-0ubuntu3.9+tuxcare.els1
bluez-cups
TuxCare:Ubuntu:18.04
 before 5.48-0ubuntu3.9+tuxcare.els1
5.48-0ubuntu3.9+tuxcare.els1
bluez-hcidump
TuxCare:Ubuntu:18.04
 before 5.48-0ubuntu3.9+tuxcare.els1
5.48-0ubuntu3.9+tuxcare.els1
bluez-obexd
TuxCare:Ubuntu:18.04
 before 5.48-0ubuntu3.9+tuxcare.els1
5.48-0ubuntu3.9+tuxcare.els1
bluez-tests
TuxCare:Ubuntu:18.04
 before 5.48-0ubuntu3.9+tuxcare.els1
5.48-0ubuntu3.9+tuxcare.els1
libbluetooth-dev
TuxCare:Ubuntu:18.04
 before 5.48-0ubuntu3.9+tuxcare.els1
5.48-0ubuntu3.9+tuxcare.els1
libbluetooth3
TuxCare:Ubuntu:18.04
 before 5.48-0ubuntu3.9+tuxcare.els1
5.48-0ubuntu3.9+tuxcare.els1
bluez
Debian:12
 before 5.66-1+deb12u2, plus listed versions
5.66-15.66-1+deb12u1
5.66-1+deb12u2
bluez
Debian:13
 before 5.68-1
5.68-1
bluez
Debian:14
 before 5.68-1
5.68-1
bluez
Debian:10
 before 5.50-1.2~deb10u5, plus listed versions
5.50-15.50-1.15.50-1.2~deb10u15.50-1.2~deb10u25.50-1.2~deb10u35.50-1.2~deb10u4
5.50-1.2~deb10u5
bluez
Debian:11
From an advisory covering 9 CVEs
 before 5.55-3.1+deb11u2, plus listed versions
5.55-3.15.55-3.1+deb11u1
5.55-3.1+deb11u2
bluez
openEuler:20.03-LTS-SP1
 before 5.54-12.oe1
5.54-12.oe1
bluez
openEuler:20.03-LTS-SP3
 before 5.54-12.oe1
5.54-12.oe1
bluez
openEuler:22.03-LTS
 before 5.54-17.oe2203sp1
5.54-17.oe2203sp1
bluez
openEuler:22.03-LTS-SP1
 before 5.54-17.oe2203sp1
5.54-17.oe2203sp1
bluez-cups
Red Hat:enterprise_linux:9::appstream
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez-cups-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez-hid2hci-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez-libs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez-libs-devel-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez-mesh-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez-obexd
Red Hat:enterprise_linux:9::appstream
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez-obexd-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez
Red Hat:enterprise_linux:9::baseos
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez-cups-debuginfo
Red Hat:enterprise_linux:9::baseos
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez-debuginfo
Red Hat:enterprise_linux:9::baseos
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez-debugsource
Red Hat:enterprise_linux:9::baseos
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez-hid2hci-debuginfo
Red Hat:enterprise_linux:9::baseos
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez-libs
Red Hat:enterprise_linux:9::baseos
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez-libs-debuginfo
Red Hat:enterprise_linux:9::baseos
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez-libs-devel-debuginfo
Red Hat:enterprise_linux:9::baseos
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez-mesh-debuginfo
Red Hat:enterprise_linux:9::baseos
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez-obexd-debuginfo
Red Hat:enterprise_linux:9::baseos
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez-cups-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez-debugsource
Red Hat:enterprise_linux:9::crb
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez-hid2hci-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez-libs-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez-libs-devel
Red Hat:enterprise_linux:9::crb
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez-libs-devel-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez-mesh-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez-obexd-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez-cups
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:5.63-5.el8_10
0:5.63-5.el8_10
bluez-cups-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:5.63-5.el8_10
0:5.63-5.el8_10
bluez-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:5.63-5.el8_10
0:5.63-5.el8_10
bluez-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:5.63-5.el8_10
0:5.63-5.el8_10
bluez-hid2hci-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:5.63-5.el8_10
0:5.63-5.el8_10
bluez-libs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:5.63-5.el8_10
0:5.63-5.el8_10
bluez-obexd-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:5.63-5.el8_10
0:5.63-5.el8_10
bluez
Red Hat:enterprise_linux:8::baseos
From an advisory covering 2 CVEs
 before 0:5.63-5.el8_10
0:5.63-5.el8_10
bluez-cups-debuginfo
Red Hat:enterprise_linux:8::baseos
From an advisory covering 2 CVEs
 before 0:5.63-5.el8_10
0:5.63-5.el8_10
bluez-debuginfo
Red Hat:enterprise_linux:8::baseos
From an advisory covering 2 CVEs
 before 0:5.63-5.el8_10
0:5.63-5.el8_10
bluez-debugsource
Red Hat:enterprise_linux:8::baseos
From an advisory covering 2 CVEs
 before 0:5.63-5.el8_10
0:5.63-5.el8_10
bluez-hid2hci
Red Hat:enterprise_linux:8::baseos
From an advisory covering 2 CVEs
 before 0:5.63-5.el8_10
0:5.63-5.el8_10
bluez-hid2hci-debuginfo
Red Hat:enterprise_linux:8::baseos
From an advisory covering 2 CVEs
 before 0:5.63-5.el8_10
0:5.63-5.el8_10
bluez-libs
Red Hat:enterprise_linux:8::baseos
From an advisory covering 2 CVEs
 before 0:5.63-5.el8_10
0:5.63-5.el8_10
bluez-libs-debuginfo
Red Hat:enterprise_linux:8::baseos
From an advisory covering 2 CVEs
 before 0:5.63-5.el8_10
0:5.63-5.el8_10
bluez-obexd
Red Hat:enterprise_linux:8::baseos
From an advisory covering 2 CVEs
 before 0:5.63-5.el8_10
0:5.63-5.el8_10
bluez-obexd-debuginfo
Red Hat:enterprise_linux:8::baseos
From an advisory covering 2 CVEs
 before 0:5.63-5.el8_10
0:5.63-5.el8_10
bluez-cups-debuginfo
Red Hat:enterprise_linux:8::crb
From an advisory covering 2 CVEs
 before 0:5.63-5.el8_10
0:5.63-5.el8_10
bluez-debuginfo
Red Hat:enterprise_linux:8::crb
From an advisory covering 2 CVEs
 before 0:5.63-5.el8_10
0:5.63-5.el8_10
bluez-debugsource
Red Hat:enterprise_linux:8::crb
From an advisory covering 2 CVEs
 before 0:5.63-5.el8_10
0:5.63-5.el8_10
bluez-hid2hci-debuginfo
Red Hat:enterprise_linux:8::crb
From an advisory covering 2 CVEs
 before 0:5.63-5.el8_10
0:5.63-5.el8_10
bluez-libs-debuginfo
Red Hat:enterprise_linux:8::crb
From an advisory covering 2 CVEs
 before 0:5.63-5.el8_10
0:5.63-5.el8_10
bluez-libs-devel
Red Hat:enterprise_linux:8::crb
From an advisory covering 2 CVEs
 before 0:5.63-5.el8_10
0:5.63-5.el8_10
bluez-obexd-debuginfo
Red Hat:enterprise_linux:8::crb
From an advisory covering 2 CVEs
 before 0:5.63-5.el8_10
0:5.63-5.el8_10
bluez
Rocky Linux:9
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:5.63-5.el8_10
0:5.63-5.el8_10
bluez
SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS
 before 5.48-150000.5.49.1
5.48-150000.5.49.1
bluez
SUSE:Linux Enterprise Server 15 SP1-LTSS
 before 5.48-150000.5.49.1
5.48-150000.5.49.1
bluez
SUSE:Linux Enterprise Server for SAP Applications 15 SP1
 before 5.48-150000.5.49.1
5.48-150000.5.49.1
bluez
SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS
 before 5.48-150200.13.25.1
5.48-150200.13.25.1
bluez
SUSE:Linux Enterprise Server 15 SP2-LTSS
 before 5.48-150200.13.25.1
5.48-150200.13.25.1
bluez
SUSE:Linux Enterprise Server for SAP Applications 15 SP2
 before 5.48-150200.13.25.1
5.48-150200.13.25.1
bluez
SUSE:Enterprise Storage 7
 before 5.48-150200.13.25.1
5.48-150200.13.25.1
bluez
SUSE:Linux Enterprise Module for Basesystem 15 SP5
 before 5.65-150500.3.3.1
5.65-150500.3.3.1
bluez
SUSE:Linux Enterprise Module for Desktop Applications 15 SP5
 before 5.65-150500.3.3.1
5.65-150500.3.3.1
bluez
SUSE:Linux Enterprise Workstation Extension 15 SP5
 before 5.65-150500.3.3.1
5.65-150500.3.3.1
bluez
openSUSE:Leap 15.5
 before 5.65-150500.3.3.1
5.65-150500.3.3.1
bluez
SUSE:OpenStack Cloud 9
 before 5.13-5.39.1
5.13-5.39.1
bluez
SUSE:OpenStack Cloud Crowbar 9
 before 5.13-5.39.1
5.13-5.39.1
bluez
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
 before 5.13-5.39.1
5.13-5.39.1
bluez
SUSE:Linux Enterprise Software Development Kit 12 SP5
 before 5.13-5.39.1
5.13-5.39.1
bluez
SUSE:Linux Enterprise Server 12 SP2-BCL
 before 5.13-5.39.1
5.13-5.39.1
bluez
SUSE:Linux Enterprise Server 12 SP4-ESPOS
 before 5.13-5.39.1
5.13-5.39.1
bluez
SUSE:Linux Enterprise Server 12 SP4-LTSS
 before 5.13-5.39.1
5.13-5.39.1
bluez
SUSE:Linux Enterprise Server 12 SP5
 before 5.13-5.39.1
5.13-5.39.1
bluez
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
 before 5.13-5.39.1
5.13-5.39.1
bluez
SUSE:Linux Enterprise Workstation Extension 12 SP5
 before 5.13-5.39.1
5.13-5.39.1
bluez
SUSE:Linux Enterprise Micro 5.3
 before 5.62-150400.4.13.1
5.62-150400.4.13.1
bluez
SUSE:Linux Enterprise Micro 5.4
 before 5.62-150400.4.13.1
5.62-150400.4.13.1
bluez
SUSE:Linux Enterprise Module for Basesystem 15 SP4
 before 5.62-150400.4.13.1
5.62-150400.4.13.1
bluez
SUSE:Linux Enterprise Module for Desktop Applications 15 SP4
 before 5.62-150400.4.13.1
5.62-150400.4.13.1
bluez
SUSE:Linux Enterprise Workstation Extension 15 SP4
 before 5.62-150400.4.13.1
5.62-150400.4.13.1
bluez
openSUSE:Leap Micro 5.3
 before 5.62-150400.4.13.1
5.62-150400.4.13.1
bluez
openSUSE:Leap 15.4
 before 5.62-150400.4.13.1
5.62-150400.4.13.1
bluez
SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS
 before 5.55-150300.3.22.1
5.55-150300.3.22.1
bluez
SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS
 before 5.55-150300.3.22.1
5.55-150300.3.22.1
bluez
SUSE:Linux Enterprise Real Time 15 SP3
 before 5.55-150300.3.22.1
5.55-150300.3.22.1
bluez
SUSE:Linux Enterprise Server 15 SP3-LTSS
 before 5.55-150300.3.22.1
5.55-150300.3.22.1
bluez
SUSE:Linux Enterprise Server for SAP Applications 15 SP3
 before 5.55-150300.3.22.1
5.55-150300.3.22.1
bluez
SUSE:Manager Proxy 4.2
 before 5.55-150300.3.22.1
5.55-150300.3.22.1
bluez
SUSE:Manager Server 4.2
 before 5.55-150300.3.22.1
5.55-150300.3.22.1
bluez
SUSE:Enterprise Storage 7.1
 before 5.55-150300.3.22.1
5.55-150300.3.22.1
bluez
Ubuntu:Pro:16.04:LTS
 before 5.37-0ubuntu5.3+esm4, plus listed versions
5.35-0ubuntu25.36-0ubuntu15.37-0ubuntu55.37-0ubuntu5.15.37-0ubuntu5.35.37-0ubuntu5.3+esm15.37-0ubuntu5.3+esm25.37-0ubuntu5.3+esm3
5.37-0ubuntu5.3+esm4
bluez
Ubuntu:Pro:18.04:LTS
 before 5.48-0ubuntu3.9+esm2, plus listed versions
5.46-0ubuntu35.46-0ubuntu45.48-0ubuntu35.48-0ubuntu3.15.48-0ubuntu3.2
Show 8 moreShow less
5.48-0ubuntu3.35.48-0ubuntu3.45.48-0ubuntu3.55.48-0ubuntu3.65.48-0ubuntu3.75.48-0ubuntu3.85.48-0ubuntu3.95.48-0ubuntu3.9+esm1
5.48-0ubuntu3.9+esm2
bluez
Ubuntu:20.04:LTS
 before 5.53-0ubuntu3.8, plus listed versions
5.50-0ubuntu45.51-0ubuntu15.51-0ubuntu25.52-0ubuntu15.52-0ubuntu2
Show 10 moreShow less
5.53-0ubuntu15.53-0ubuntu25.53-0ubuntu35.53-0ubuntu3.15.53-0ubuntu3.25.53-0ubuntu3.35.53-0ubuntu3.45.53-0ubuntu3.55.53-0ubuntu3.65.53-0ubuntu3.7
5.53-0ubuntu3.8
bluez
Ubuntu:22.04:LTS
 before 5.64-0ubuntu1.3, plus listed versions
5.60-0ubuntu25.62-0ubuntu15.62-0ubuntu25.63-0ubuntu15.63-0ubuntu25.64-0ubuntu15.64-0ubuntu1.1
5.64-0ubuntu1.3
bluez
Ubuntu:Pro:16.04:LTS
From an advisory covering 2 CVEs
 before 5.37-0ubuntu5.3+esm4, plus listed versions
5.35-0ubuntu25.36-0ubuntu15.37-0ubuntu55.37-0ubuntu5.15.37-0ubuntu5.35.37-0ubuntu5.3+esm15.37-0ubuntu5.3+esm25.37-0ubuntu5.3+esm3
5.37-0ubuntu5.3+esm4
bluez
Ubuntu:Pro:18.04:LTS
From an advisory covering 2 CVEs
 before 5.48-0ubuntu3.9+esm2, plus listed versions
5.46-0ubuntu35.46-0ubuntu45.48-0ubuntu35.48-0ubuntu3.15.48-0ubuntu3.2
Show 8 moreShow less
5.48-0ubuntu3.35.48-0ubuntu3.45.48-0ubuntu3.55.48-0ubuntu3.65.48-0ubuntu3.75.48-0ubuntu3.85.48-0ubuntu3.95.48-0ubuntu3.9+esm1
5.48-0ubuntu3.9+esm2
bluez
Ubuntu:20.04:LTS
From an advisory covering 2 CVEs
 before 5.53-0ubuntu3.8, plus listed versions
5.50-0ubuntu45.51-0ubuntu15.51-0ubuntu25.52-0ubuntu15.52-0ubuntu2
Show 10 moreShow less
5.53-0ubuntu15.53-0ubuntu25.53-0ubuntu35.53-0ubuntu3.15.53-0ubuntu3.25.53-0ubuntu3.35.53-0ubuntu3.45.53-0ubuntu3.55.53-0ubuntu3.65.53-0ubuntu3.7
5.53-0ubuntu3.8
bluez
Ubuntu:22.04:LTS
From an advisory covering 2 CVEs
 before 5.64-0ubuntu1.3, plus listed versions
5.60-0ubuntu25.62-0ubuntu15.62-0ubuntu25.63-0ubuntu15.63-0ubuntu25.64-0ubuntu15.64-0ubuntu1.1
5.64-0ubuntu1.3
bluez
openSUSE:Tumbleweed
 before 5.68-2.1
5.68-2.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-27349 is a high vulnerability (CVSS 7.1) in Bluez, published April 21, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.43%, the 73rd percentile. Fixed in bluez 5.64-2.el9.tuxcare.els1.

References

Show 76 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open