{"id":"CVE-2017-1000250","aliases":["ALPINE-CVE-2017-1000250","DEBIAN-CVE-2017-1000250","DLA-1103-1","DSA-3972-1","EUVD-2017-1511","GHSA-6fxm-r64m-667w","MGASA-2017-0350","RHSA-2017:2685","SUSE-SU-2018:1778-1","SUSE-SU-2019:0510-1","UBUNTU-CVE-2017-1000250","USN-3413-1"],"status":"published","title":"All versions of the SDP server in BlueZ 5.46 and earlier are vulnerable to an information...","description":"All versions of the SDP server in BlueZ 5.46 and earlier are vulnerable to an information disclosure vulnerability which allows remote attackers to obtain sensitive information from the bluetoothd process memory. This vulnerability lies in the processing of SDP search attribute requests.","severity":{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.07774,"percentile":0.94686,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-200"],"published":"2017-09-12T13:00:00Z","modified":"2026-10-24T10:30:19Z","exploits":[{"source":"pocgithub","id":"olav-st/CVE-2017-1000250-PoC","title":"olav-st/CVE-2017-1000250-PoC","date":"2017-11-12","url":"https://github.com/olav-st/CVE-2017-1000250-PoC"}],"fixes":[{"ecosystem":"Alpine:v3.3","package":"bluez","fixed_in":["5.36-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.4","package":"bluez","fixed_in":["5.40-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.5","package":"bluez","fixed_in":["5.42-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.6","package":"bluez","fixed_in":["5.44-r3"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"bluez","fixed_in":["5.46-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"bluez","fixed_in":["5.46-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"bluez","fixed_in":["5.46-1"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"bluez","fixed_in":["4.99-2+deb7u1"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"bluez","fixed_in":["5.23-2+deb8u1"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"bluez","fixed_in":["5.43-2+deb9u1"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"bluez","fixed_in":["5.28-1.1.mga5"],"sources":["osv"]},{"ecosystem":"Mageia:6","package":"bluez","fixed_in":["5.45-2.1.mga6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"bluez","fixed_in":["0:4.66-2.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"bluez-debuginfo","fixed_in":["0:4.66-2.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"bluez-libs","fixed_in":["0:4.66-2.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"bluez-alsa","fixed_in":["0:4.66-2.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"bluez-compat","fixed_in":["0:4.66-2.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"bluez-cups","fixed_in":["0:4.66-2.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"bluez-gstreamer","fixed_in":["0:4.66-2.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"bluez-libs-devel","fixed_in":["0:4.66-2.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"bluez","fixed_in":["0:4.66-2.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"bluez-alsa","fixed_in":["0:4.66-2.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"bluez-compat","fixed_in":["0:4.66-2.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"bluez-cups","fixed_in":["0:4.66-2.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"bluez-debuginfo","fixed_in":["0:4.66-2.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"bluez-gstreamer","fixed_in":["0:4.66-2.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"bluez-libs","fixed_in":["0:4.66-2.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"bluez-libs-devel","fixed_in":["0:4.66-2.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"bluez","fixed_in":["0:4.66-2.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"bluez-debuginfo","fixed_in":["0:4.66-2.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"bluez-libs","fixed_in":["0:4.66-2.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"bluez-alsa","fixed_in":["0:4.66-2.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"bluez-compat","fixed_in":["0:4.66-2.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"bluez-cups","fixed_in":["0:4.66-2.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"bluez-gstreamer","fixed_in":["0:4.66-2.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"bluez-libs-devel","fixed_in":["0:4.66-2.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"bluez","fixed_in":["0:4.66-2.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"bluez-debuginfo","fixed_in":["0:4.66-2.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"bluez-libs","fixed_in":["0:4.66-2.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"bluez-alsa","fixed_in":["0:4.66-2.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"bluez-compat","fixed_in":["0:4.66-2.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"bluez-cups","fixed_in":["0:4.66-2.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"bluez-gstreamer","fixed_in":["0:4.66-2.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"bluez-libs-devel","fixed_in":["0:4.66-2.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"bluez","fixed_in":["0:5.44-4.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"bluez-debuginfo","fixed_in":["0:5.44-4.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"bluez-libs","fixed_in":["0:5.44-4.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"bluez-cups","fixed_in":["0:5.44-4.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"bluez-hid2hci","fixed_in":["0:5.44-4.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"bluez-libs-devel","fixed_in":["0:5.44-4.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"bluez","fixed_in":["0:5.44-4.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"bluez-debuginfo","fixed_in":["0:5.44-4.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"bluez-libs","fixed_in":["0:5.44-4.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"bluez-cups","fixed_in":["0:5.44-4.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"bluez-hid2hci","fixed_in":["0:5.44-4.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"bluez-libs-devel","fixed_in":["0:5.44-4.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"bluez","fixed_in":["0:5.44-4.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"bluez-debuginfo","fixed_in":["0:5.44-4.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"bluez-libs","fixed_in":["0:5.44-4.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"bluez-cups","fixed_in":["0:5.44-4.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"bluez-hid2hci","fixed_in":["0:5.44-4.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"bluez-libs-devel","fixed_in":["0:5.44-4.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"bluez","fixed_in":["0:5.44-4.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"bluez-debuginfo","fixed_in":["0:5.44-4.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"bluez-libs","fixed_in":["0:5.44-4.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"bluez-cups","fixed_in":["0:5.44-4.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"bluez-hid2hci","fixed_in":["0:5.44-4.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"bluez-libs-devel","fixed_in":["0:5.44-4.el7_4"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"bluez","fixed_in":["4.101-0ubuntu13.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"bluez","fixed_in":["5.37-0ubuntu5.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.3","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.36-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.4","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.40-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.5","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.42-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.6","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.44-r3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.46-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.46-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.46-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.99-2+deb7u1"}]}],"versions":["4.99-2"]},{"source":"osv","ecosystem":"Debian:8","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.23-2+deb8u1"}]}],"versions":["5.23-2"]},{"source":"osv","ecosystem":"Debian:9","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.43-2+deb9u1"}]}],"versions":["5.43-2"]},{"source":"osv","ecosystem":"Mageia:5","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.28-1.1.mga5"}]}]},{"source":"osv","ecosystem":"Mageia:6","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.45-2.1.mga6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.66-2.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"bluez-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.66-2.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"bluez-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.66-2.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"bluez-alsa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.66-2.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"bluez-compat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.66-2.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"bluez-cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.66-2.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"bluez-gstreamer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.66-2.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"bluez-libs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.66-2.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.66-2.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"bluez-alsa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.66-2.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"bluez-compat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.66-2.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"bluez-cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.66-2.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"bluez-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.66-2.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"bluez-gstreamer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.66-2.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"bluez-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.66-2.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"bluez-libs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.66-2.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.66-2.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"bluez-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.66-2.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"bluez-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.66-2.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"bluez-alsa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.66-2.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"bluez-compat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.66-2.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"bluez-cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.66-2.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"bluez-gstreamer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.66-2.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"bluez-libs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.66-2.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.66-2.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"bluez-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.66-2.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"bluez-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.66-2.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"bluez-alsa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.66-2.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"bluez-compat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.66-2.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"bluez-cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.66-2.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"bluez-gstreamer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.66-2.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"bluez-libs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.66-2.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.44-4.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"bluez-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.44-4.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"bluez-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.44-4.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"bluez-cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.44-4.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"bluez-hid2hci","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.44-4.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"bluez-libs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.44-4.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.44-4.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"bluez-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.44-4.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"bluez-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.44-4.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"bluez-cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.44-4.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"bluez-hid2hci","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.44-4.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"bluez-libs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.44-4.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.44-4.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"bluez-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.44-4.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"bluez-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.44-4.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"bluez-cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.44-4.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"bluez-hid2hci","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.44-4.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"bluez-libs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.44-4.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.44-4.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"bluez-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.44-4.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"bluez-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.44-4.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"bluez-cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.44-4.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"bluez-hid2hci","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.44-4.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"bluez-libs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.44-4.el7_4"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.13-5.4.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.13-5.4.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.13-5.4.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.13-5.4.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP3","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.13-5.4.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.13-3.10.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.13-3.10.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.13-3.10.1"}]}],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.101-0ubuntu13.3"}]}],"versions":["4.101-0ubuntu8b1","4.101-0ubuntu9","4.101-0ubuntu10","4.101-0ubuntu11","4.101-0ubuntu12","4.101-0ubuntu13","4.101-0ubuntu13.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.37-0ubuntu5.1"}]}],"versions":["5.35-0ubuntu2","5.36-0ubuntu1","5.37-0ubuntu5"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.101-0ubuntu13.3"}]}],"versions":["4.101-0ubuntu8b1","4.101-0ubuntu9","4.101-0ubuntu10","4.101-0ubuntu11","4.101-0ubuntu12","4.101-0ubuntu13","4.101-0ubuntu13.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.37-0ubuntu5.1"}]}],"versions":["5.35-0ubuntu2","5.36-0ubuntu1","5.37-0ubuntu5"]}],"products":[{"vendor":"bluez","product":"bluez"}],"references":[{"url":"https://access.redhat.com/security/vulnerabilities/blueborne","tags":["x_refsource_CONFIRM","x_transferred","Not Applicable","web"]},{"url":"https://www.armis.com/blueborne","tags":["x_refsource_MISC","x_transferred","Exploit","Technical Description","Third Party Advisory","evidence","report"]},{"url":"http://www.debian.org/security/2017/dsa-3972","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"https://www.synology.com/support/security/Synology_SA_17_52_BlueBorne","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.securityfocus.com/bid/100814","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://nvidia.custhelp.com/app/answers/detail/a_id/4561","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://www.kb.cert.org/vuls/id/240311","tags":["third-party-advisory","x_refsource_CERT-VN","x_transferred","Third Party Advisory","US Government Resource","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2017:2685","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000250","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-1000250","tags":["Issue Tracking","Third Party Advisory","VDB Entry","report"]},{"url":"https://github.com/advisories/GHSA-6fxm-r64m-667w"},{"url":"https://security.alpinelinux.org/vuln/CVE-2017-1000250","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-1000250","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2017-0350.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=21698","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1489446","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_2685.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-1000250","tags":["advisory","report"]},{"url":"https://www.armis.com/blueborne/","tags":["article"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20181778-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1013721","tags":["report"]},{"url":"https://bugzilla.suse.com/1013877","tags":["report"]},{"url":"https://bugzilla.suse.com/1026652","tags":["report"]},{"url":"https://bugzilla.suse.com/1057342","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7837","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9800","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9804","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000250","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190510-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1013732","tags":["report"]},{"url":"https://bugzilla.suse.com/1015173","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9801","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9918","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2017-1000250","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3413-1","tags":["advisory"]},{"url":"https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/BlueBorne","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-1000250","description":"All versions of the SDP server in BlueZ 5.46 and earlier are vulnerable to an information disclosure vulnerability which allows remote attackers to obtain sensitive information from the bluetoothd process memory. This vulnerability lies in the processing of SDP search attribute requests.","status":"published","published":"2017-09-12T17:00:00Z","modified":"2024-08-05T22:00:39.877Z","updated_at":"2026-11-02T14:33:20.843976Z"}],"euvd":[{"id":"EUVD-2017-1511","description":"All versions of the SDP server in BlueZ 5.46 and earlier are vulnerable to an information disclosure vulnerability which allows remote attackers to obtain sensitive information from the bluetoothd process memory. This vulnerability lies in the processing of SDP search attribute requests.","status":"published","published":"2017-09-12T17:00:00Z","modified":"2024-08-05T22:00:39Z","updated_at":"2026-11-03T02:23:03.593375Z"}],"ghsa":[{"id":"GHSA-6fxm-r64m-667w","title":"All versions of the SDP server in BlueZ 5.46 and earlier are vulnerable to an information...","description":"All versions of the SDP server in BlueZ 5.46 and earlier are vulnerable to an information disclosure vulnerability which allows remote attackers to obtain sensitive information from the bluetoothd process memory. This vulnerability lies in the processing of SDP search attribute requests.","status":"published","published":"2022-05-14T03:44:29Z","modified":"2023-02-02T05:10:06Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:52:46.933473Z"}],"nvd":[{"id":"CVE-2017-1000250","description":"All versions of the SDP server in BlueZ 5.46 and earlier are vulnerable to an information disclosure vulnerability which allows remote attackers to obtain sensitive information from the bluetoothd process memory. This vulnerability lies in the processing of SDP search attribute requests.","status":"published","published":"2017-09-12T17:29:00.197Z","modified":"2026-06-17T00:58:58.96Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":3.3,"vector":"AV:A/AC:L/Au:N/C:P/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:03:58.85945Z"}],"osv":[{"id":"ALPINE-CVE-2017-1000250","description":"All versions of the SDP server in BlueZ 5.46 and earlier are vulnerable to an information disclosure vulnerability which allows remote attackers to obtain sensitive information from the bluetoothd process memory. This vulnerability lies in the processing of SDP search attribute requests.","status":"published","published":"2017-09-12T17:29:00.197Z","modified":"2026-06-15T18:23:54.918470016Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:27:46.716249Z"},{"id":"CVE-2017-1000250","description":"All versions of the SDP server in BlueZ 5.46 and earlier are vulnerable to an information disclosure vulnerability which allows remote attackers to obtain sensitive information from the bluetoothd process memory. This vulnerability lies in the processing of SDP search attribute requests.","status":"published","published":"2017-09-12T17:29:00.197Z","modified":"2026-10-24T10:30:19.565012547Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:03.851821Z"},{"id":"DEBIAN-CVE-2017-1000250","description":"All versions of the SDP server in BlueZ 5.46 and earlier are vulnerable to an information disclosure vulnerability which allows remote attackers to obtain sensitive information from the bluetoothd process memory. This vulnerability lies in the processing of SDP search attribute requests.","status":"published","published":"2017-09-12T17:29:00.197Z","modified":"2026-09-01T20:03:40.355696277Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:28.207321Z"},{"id":"RHSA-2017:2685","title":"Red Hat Security Advisory: bluez security update","status":"published","published":"2024-09-16T00:41:11Z","modified":"2026-06-26T12:21:54.585617123Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:04.262457Z"},{"id":"UBUNTU-CVE-2017-1000250","description":"All versions of the SDP server in BlueZ 5.46 and earlier are vulnerable to an information disclosure vulnerability which allows remote attackers to obtain sensitive information from the bluetoothd process memory. This vulnerability lies in the processing of SDP search attribute requests.","status":"published","published":"2017-09-12T13:00:00Z","modified":"2026-04-22T11:08:27.161422Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:13.729565Z"},{"id":"DLA-1103-1","title":"bluez - security update","status":"published","published":"2017-09-21T00:00:00Z","modified":"2026-03-09T01:01:40.835058Z","updated_at":"2026-11-02T15:46:09.336894Z"},{"id":"DSA-3972-1","title":"bluez - security update","status":"published","published":"2017-09-13T00:00:00Z","modified":"2026-03-09T01:22:43.541079Z","updated_at":"2026-11-02T15:46:16.523846Z"},{"id":"MGASA-2017-0350","title":"Updated bluez packages fix security vulnerability","description":"An information-disclosure flaw was found in the bluetoothd\nimplementation of the Service Discovery Protocol (SDP). A specially\ncrafted Bluetooth device could, without prior pairing or user\ninteraction, retrieve portions of the bluetoothd process memory,\nincluding potentially sensitive information such as Bluetooth encryption\nkeys (CVE-2017-1000250).\n","status":"published","published":"2017-09-21T13:43:32Z","modified":"2026-04-16T06:25:01.28821257Z","updated_at":"2026-11-02T15:49:40.442238Z"},{"id":"SUSE-SU-2018:1778-1","title":"Security update for bluez","description":"This update for bluez fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2016-9800: Fix hcidump memory leak in pin_code_reply_dump() (bsc#1013721).\n- CVE-2016-9804: Fix hcidump buffer overflow in commands_dump() (bsc#1013877).\n- CVE-2016-7837: Fix possible buffer overflow, make sure we don't write past the end of the array (bsc#1026652).\n- CVE-2017-1000250: Fix information disclosure vulnerability in service_search_attr_req (bsc#1057342).\n","status":"published","published":"2018-06-21T08:41:05Z","modified":"2026-02-04T03:32:30.969978Z","updated_at":"2026-11-02T15:53:44.972817Z"},{"id":"SUSE-SU-2019:0510-1","title":"Security update for bluez","description":"This update for bluez fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2016-7837: Fixed possible buffer overflow, make sure we don't write past the end of the array.(bsc#1026652)\n- CVE-2016-9800: Fix hcidump memory leak in pin_code_reply_dump() (bsc#1013721).\n- CVE-2016-9801: Fixed a buffer overflow in set_ext_ctrl function (bsc#1013732)\n- CVE-2016-9804: Fix hcidump buffer overflow in commands_dump() (bsc#1013877).\n- CVE-2016-9918: Fixed an out-of-bounds read in packet_hexdump() (bsc#1015173)\n- CVE-2017-1000250: Fixed a information leak in SDP (part of the recently published BlueBorne vulnerabilities) (bsc#1057342)\n","status":"published","published":"2019-02-28T08:53:14Z","modified":"2026-02-04T04:02:50.920478Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"USN-3413-1","title":"bluez vulnerability","description":"It was discovered that an information disclosure vulnerability existed\nin the Service Discovery Protocol (SDP) implementation in BlueZ. A\nphysically proximate unauthenticated attacker could use this to\ndisclose sensitive information. (CVE-2017-1000250)\n","status":"published","published":"2017-09-12T18:25:44Z","modified":"2026-04-22T09:39:19.258582Z","updated_at":"2026-11-02T16:58:13.496563Z"}]}}