CVE-2008-2374

src/sdp.c in bluez-libs 3.30 in BlueZ, and other bluez-libs before 3.34 and bluez-utils before 3...

7.5 HighFix available

src/sdp.c in bluez-libs 3.30 in BlueZ, and other bluez-libs before 3.34 and bluez-utils before 3.34 versions, does not validate string length fields in SDP packets, which allows remote SDP servers to cause a denial of service or possibly have unspecified other impact via a crafted length field that triggers excessive memory allocation or a buffer over-read.

Exploit likelihood

4.29%Up 1.6 points since Feb 4, 2022

What each source reports

CVE List 9.8

Record: CVE-2008-2374
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-1284
Updated: 2026-11-02

EUVDEUVD-2008-2369 9.8

Record: EUVD-2008-2369
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-03

GitHub AdvisoriesGHSA-278x-6vg6-6g42 9.8

src/sdp.c in bluez-libs 3.30 in BlueZ, and other bluez-libs before 3.34 and bluez-utils before 3...

Record: GHSA-278x-6vg6-6g42
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-20, CWE-1284
Updated: 2026-11-02

NVD 9.8

Record: CVE-2008-2374
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-1284
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10503-1 No score

obex-data-server-0.4.6-15.8 on GA media

These are all security issues fixed in the obex-data-server-0.4.6-15.8 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:10503-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`bluez-libs` Red Hat:enterprise_linux:4::as	before 0:2.10-3	0:2.10-3
`bluez-libs-debuginfo` Red Hat:enterprise_linux:4::as	before 0:2.10-3	0:2.10-3
`bluez-libs-devel` Red Hat:enterprise_linux:4::as	before 0:2.10-3	0:2.10-3
`bluez-utils` Red Hat:enterprise_linux:4::as	before 0:2.10-2.4	0:2.10-2.4
`bluez-utils-cups` Red Hat:enterprise_linux:4::as	before 0:2.10-2.4	0:2.10-2.4
`bluez-utils-debuginfo` Red Hat:enterprise_linux:4::as	before 0:2.10-2.4	0:2.10-2.4
`bluez-libs` Red Hat:enterprise_linux:4::desktop	before 0:2.10-3	0:2.10-3
`bluez-libs-debuginfo` Red Hat:enterprise_linux:4::desktop	before 0:2.10-3	0:2.10-3
`bluez-libs-devel` Red Hat:enterprise_linux:4::desktop	before 0:2.10-3	0:2.10-3
`bluez-utils` Red Hat:enterprise_linux:4::desktop	before 0:2.10-2.4	0:2.10-2.4

Show 29 moreShow less

Affected packages
Package	Affected	Fixed
`bluez-utils-cups` Red Hat:enterprise_linux:4::desktop	before 0:2.10-2.4	0:2.10-2.4
`bluez-utils-debuginfo` Red Hat:enterprise_linux:4::desktop	before 0:2.10-2.4	0:2.10-2.4
`bluez-libs` Red Hat:enterprise_linux:4::es	before 0:2.10-3	0:2.10-3
`bluez-libs-debuginfo` Red Hat:enterprise_linux:4::es	before 0:2.10-3	0:2.10-3
`bluez-libs-devel` Red Hat:enterprise_linux:4::es	before 0:2.10-3	0:2.10-3
`bluez-utils` Red Hat:enterprise_linux:4::es	before 0:2.10-2.4	0:2.10-2.4
`bluez-utils-cups` Red Hat:enterprise_linux:4::es	before 0:2.10-2.4	0:2.10-2.4
`bluez-utils-debuginfo` Red Hat:enterprise_linux:4::es	before 0:2.10-2.4	0:2.10-2.4
`bluez-libs` Red Hat:enterprise_linux:4::ws	before 0:2.10-3	0:2.10-3
`bluez-libs-debuginfo` Red Hat:enterprise_linux:4::ws	before 0:2.10-3	0:2.10-3
`bluez-libs-devel` Red Hat:enterprise_linux:4::ws	before 0:2.10-3	0:2.10-3
`bluez-utils` Red Hat:enterprise_linux:4::ws	before 0:2.10-2.4	0:2.10-2.4
`bluez-utils-cups` Red Hat:enterprise_linux:4::ws	before 0:2.10-2.4	0:2.10-2.4
`bluez-utils-debuginfo` Red Hat:enterprise_linux:4::ws	before 0:2.10-2.4	0:2.10-2.4
`bluez-libs` Red Hat:enterprise_linux:5::client_workstation	before 0:3.7-1.1	0:3.7-1.1
`bluez-libs-debuginfo` Red Hat:enterprise_linux:5::client_workstation	before 0:3.7-1.1	0:3.7-1.1
`bluez-libs-devel` Red Hat:enterprise_linux:5::client_workstation	before 0:3.7-1.1	0:3.7-1.1
`bluez-libs` Red Hat:enterprise_linux:5::client	before 0:3.7-1.1	0:3.7-1.1
`bluez-libs-debuginfo` Red Hat:enterprise_linux:5::client	before 0:3.7-1.1	0:3.7-1.1
`bluez-utils` Red Hat:enterprise_linux:5::client	before 0:3.7-2.2	0:3.7-2.2
`bluez-utils-cups` Red Hat:enterprise_linux:5::client	before 0:3.7-2.2	0:3.7-2.2
`bluez-utils-debuginfo` Red Hat:enterprise_linux:5::client	before 0:3.7-2.2	0:3.7-2.2
`bluez-libs` Red Hat:enterprise_linux:5::server	before 0:3.7-1.1	0:3.7-1.1
`bluez-libs-debuginfo` Red Hat:enterprise_linux:5::server	before 0:3.7-1.1	0:3.7-1.1
`bluez-libs-devel` Red Hat:enterprise_linux:5::server	before 0:3.7-1.1	0:3.7-1.1
`bluez-utils` Red Hat:enterprise_linux:5::server	before 0:3.7-2.2	0:3.7-2.2
`bluez-utils-cups` Red Hat:enterprise_linux:5::server	before 0:3.7-2.2	0:3.7-2.2
`bluez-utils-debuginfo` Red Hat:enterprise_linux:5::server	before 0:3.7-2.2	0:3.7-2.2
`obex-data-server` openSUSE:Tumbleweed	before 0.4.6-15.8	0.4.6-15.8

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2008-2374 is a high vulnerability (CVSS 7.5) in Bluez Bluez-libs, published July 7, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.29%, the 91st percentile. Fixed in bluez-libs 0:2.10-3.

References

Show 23 moreShow less