{"id":"CVE-2019-8921","aliases":["DEBIAN-CVE-2019-8921","DLA-2827-1","DLA-3157-1","EUVD-2019-18309","GHSA-69h8-fh92-ch8q","SUSE-SU-2022:3687-1","SUSE-SU-2022:3691-1","SUSE-SU-2022:3718-1","UBUNTU-CVE-2019-8921","USN-7265-1"],"status":"published","title":"An issue was discovered in bluetoothd in BlueZ through 5.48. The vulnerability lies in the...","description":"An issue was discovered in bluetoothd in BlueZ through 5.48. The vulnerability lies in the handling of a SVC_ATTR_REQ by the SDP implementation. By crafting a malicious CSTATE, it is possible to trick the server into returning more bytes than the buffer actually holds, resulting in leaking arbitrary heap data. The root cause can be found in the function service_attr_req of sdpd-request.c. The server does not check whether the CSTATE data is the same in consecutive requests, and instead simply trusts that it is the same.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01007,"percentile":0.63276,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-345"],"published":"2021-11-27T00:00:00Z","modified":"2026-09-21T07:03:25Z","fixes":[{"ecosystem":"Debian:12","package":"bluez","fixed_in":["5.54-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"bluez","fixed_in":["5.54-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"bluez","fixed_in":["5.54-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"bluez","fixed_in":["5.37-0ubuntu5.3+esm5"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"bluez","fixed_in":["5.48-0ubuntu3.6"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.54-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.54-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.54-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.43-2+deb9u5"}]}],"versions":["5.43-2","5.43-2+deb9u1","5.43-2+deb9u2","5.43-2+deb9u2~deb8u1","5.43-2+deb9u3","5.43-2+deb9u4"],"bundled":3},{"source":"osv","ecosystem":"Debian:10","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.50-1.2~deb10u3"}]}],"versions":["5.50-1","5.50-1.1","5.50-1.2~deb10u1","5.50-1.2~deb10u2"],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.48-150000.5.41.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.48-150000.5.41.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.48-150000.5.41.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.48-150000.5.41.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.48-150000.5.41.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.48-150000.5.41.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.48-150000.5.41.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.48-150000.5.41.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.48-150000.5.41.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.48-150000.5.41.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.48-150200.13.17.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.48-150200.13.17.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.48-150200.13.17.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.48-150200.13.17.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.48-150200.13.17.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.1","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.48-150200.13.17.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.48-150200.13.17.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Manager Server 4.1","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.48-150200.13.17.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.48-150200.13.17.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.13-5.31.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.13-5.31.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.13-5.31.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.13-5.31.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.13-5.31.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.13-5.31.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.13-5.31.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.13-5.31.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.13-5.31.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP5","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.13-5.31.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.37-0ubuntu5.3+esm5"}]}],"versions":["5.35-0ubuntu2","5.36-0ubuntu1","5.37-0ubuntu5","5.37-0ubuntu5.1","5.37-0ubuntu5.3","5.37-0ubuntu5.3+esm1","5.37-0ubuntu5.3+esm2","5.37-0ubuntu5.3+esm3","5.37-0ubuntu5.3+esm4"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.48-0ubuntu3.6"}]}],"versions":["5.46-0ubuntu3","5.46-0ubuntu4","5.48-0ubuntu3","5.48-0ubuntu3.1","5.48-0ubuntu3.2","5.48-0ubuntu3.3","5.48-0ubuntu3.4","5.48-0ubuntu3.5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.37-0ubuntu5.3+esm5"}]}],"versions":["5.35-0ubuntu2","5.36-0ubuntu1","5.37-0ubuntu5","5.37-0ubuntu5.1","5.37-0ubuntu5.3","5.37-0ubuntu5.3+esm1","5.37-0ubuntu5.3+esm2","5.37-0ubuntu5.3+esm3","5.37-0ubuntu5.3+esm4"],"bundled":2}],"products":[{"vendor":"bluez","product":"bluez"},{"vendor":"debian","product":"debian_linux"}],"references":[{"url":"https://ssd-disclosure.com/ssd-advisory-linux-bluez-information-leak-and-heap-overflow/","tags":["x_transferred","Exploit","Patch","Third Party Advisory","fix","report"]},{"url":"https://security.netapp.com/advisory/ntap-20211203-0002/","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/10/msg00026.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-8921"},{"url":"https://security.netapp.com/advisory/ntap-20211203-0002"},{"url":"https://ssd-disclosure.com/ssd-advisory-linux-bluez-information-leak-and-heap-overflow"},{"url":"https://github.com/advisories/GHSA-69h8-fh92-ch8q"},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-8921","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223687-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1186463","tags":["report"]},{"url":"https://bugzilla.suse.com/1188859","tags":["report"]},{"url":"https://bugzilla.suse.com/1192394","tags":["report"]},{"url":"https://bugzilla.suse.com/1193227","tags":["report"]},{"url":"https://bugzilla.suse.com/1193237","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8921","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8922","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26558","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-0129","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3658","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-43400","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223691-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223718-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1013885","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9803","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2019-8921","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-8921","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7265-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-8922","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2019-8921","description":"An issue was discovered in bluetoothd in BlueZ through 5.48. The vulnerability lies in the handling of a SVC_ATTR_REQ by the SDP implementation. By crafting a malicious CSTATE, it is possible to trick the server into returning more bytes than the buffer actually holds, resulting in leaking arbitrary heap data. The root cause can be found in the function service_attr_req of sdpd-request.c. The server does not check whether the CSTATE data is the same in consecutive requests, and instead simply trusts that it is the same.","status":"published","published":"2021-11-29T00:00:00Z","modified":"2026-04-15T21:08:51.808Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-345"],"updated_at":"2026-11-02T14:20:21.703364Z"}],"euvd":[{"id":"EUVD-2019-18309","description":"An issue was discovered in bluetoothd in BlueZ through 5.48. The vulnerability lies in the handling of a SVC_ATTR_REQ by the SDP implementation. By crafting a malicious CSTATE, it is possible to trick the server into returning more bytes than the buffer actually holds, resulting in leaking arbitrary heap data. The root cause can be found in the function service_attr_req of sdpd-request.c. The server does not check whether the CSTATE data is the same in consecutive requests, and instead simply trusts that it is the same.","status":"published","published":"2021-11-29T00:00:00Z","modified":"2026-04-15T21:08:51Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T19:24:24.796113Z"}],"ghsa":[{"id":"GHSA-69h8-fh92-ch8q","title":"An issue was discovered in bluetoothd in BlueZ through 5.48. The vulnerability lies in the...","description":"An issue was discovered in bluetoothd in BlueZ through 5.48. The vulnerability lies in the handling of a SVC_ATTR_REQ by the SDP implementation. By crafting a malicious CSTATE, it is possible to trick the server into returning more bytes than the buffer actually holds, resulting in leaking arbitrary heap data. The root cause can be found in the function service_attr_req of sdpd-request.c. The server does not check whether the CSTATE data is the same in consecutive requests, and instead simply trusts that it is the same.","status":"published","published":"2021-11-30T00:00:52Z","modified":"2026-04-15T21:31:16Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-345"],"updated_at":"2026-11-02T15:07:30.592661Z"}],"nvd":[{"id":"CVE-2019-8921","description":"An issue was discovered in bluetoothd in BlueZ through 5.48. The vulnerability lies in the handling of a SVC_ATTR_REQ by the SDP implementation. By crafting a malicious CSTATE, it is possible to trick the server into returning more bytes than the buffer actually holds, resulting in leaking arbitrary heap data. The root cause can be found in the function service_attr_req of sdpd-request.c. The server does not check whether the CSTATE data is the same in consecutive requests, and instead simply trusts that it is the same.","status":"published","published":"2021-11-29T08:15:07.573Z","modified":"2026-06-17T02:42:47.187Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"2.0","score":3.3,"vector":"AV:A/AC:L/Au:N/C:P/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-345"],"updated_at":"2026-11-02T14:05:48.502374Z"}],"osv":[{"id":"CVE-2019-8921","description":"An issue was discovered in bluetoothd in BlueZ through 5.48. The vulnerability lies in the handling of a SVC_ATTR_REQ by the SDP implementation. By crafting a malicious CSTATE, it is possible to trick the server into returning more bytes than the buffer actually holds, resulting in leaking arbitrary heap data. The root cause can be found in the function service_attr_req of sdpd-request.c. The server does not check whether the CSTATE data is the same in consecutive requests, and instead simply trusts that it is the same.","status":"published","published":"2021-11-29T08:15:07.573Z","modified":"2026-04-10T04:20:39.302604Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:12.974481Z"},{"id":"DEBIAN-CVE-2019-8921","description":"An issue was discovered in bluetoothd in BlueZ through 5.48. The vulnerability lies in the handling of a SVC_ATTR_REQ by the SDP implementation. By crafting a malicious CSTATE, it is possible to trick the server into returning more bytes than the buffer actually holds, resulting in leaking arbitrary heap data. The root cause can be found in the function service_attr_req of sdpd-request.c. The server does not check whether the CSTATE data is the same in consecutive requests, and instead simply trusts that it is the same.","status":"published","published":"2021-11-29T08:15:07.573Z","modified":"2026-09-21T07:03:25.407654963Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:32.57265Z"},{"id":"UBUNTU-CVE-2019-8921","description":"An issue was discovered in bluetoothd in BlueZ through 5.48. The vulnerability lies in the handling of a SVC_ATTR_REQ by the SDP implementation. By crafting a malicious CSTATE, it is possible to trick the server into returning more bytes than the buffer actually holds, resulting in leaking arbitrary heap data. The root cause can be found in the function service_attr_req of sdpd-request.c. The server does not check whether the CSTATE data is the same in consecutive requests, and instead simply trusts that it is the same.","status":"published","published":"2021-11-29T08:15:00Z","modified":"2026-04-27T09:10:24.644605Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:22.212782Z"},{"id":"DLA-2827-1","title":"bluez - security update","status":"published","published":"2021-11-27T00:00:00Z","modified":"2026-03-09T01:20:10.647086Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"DLA-3157-1","title":"bluez - security update","status":"published","published":"2022-10-24T00:00:00Z","modified":"2026-03-09T01:20:16.94095Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"SUSE-SU-2022:3687-1","title":"Security update for bluez","description":"This update for bluez fixes the following issues:\n\n- CVE-2021-0129: Fixed improper access control (bsc#1186463).\n- CVE-2020-26558: Fixed vulnerability that may permit a nearby man-in-the-middle attacker to identify the Passkey (bsc#1186463).\n- CVE-2019-8921: Fixed heap-based buffer overflow via crafted request (bsc#1193237).\n- CVE-2019-8922: Fixed heap-based buffer overflow via crafted request (bsc#1193227).\n- CVE-2021-3658: Fixed adapter incorrectly restoring discoverable state after powered down (bsc#1188859).\n- CVE-2021-43400: Fixed use-after-free in gatt-database.c (bsc#1192394).\n\n","status":"published","published":"2022-10-21T12:05:54Z","modified":"2026-02-04T02:13:12.565158Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"SUSE-SU-2022:3691-1","title":"Security update for bluez","description":"This update for bluez fixes the following issues:\n\n- CVE-2019-8921: Fixed heap-based buffer overflow via crafted request (bsc#1193237).\n- CVE-2019-8922: Fixed heap-based buffer overflow via crafted request (bsc#1193227).\n- CVE-2020-26558: Fixed vulnerability that may permit a nearby man-in-the-middle attacker to identify the Passkey (bsc#1186463).\n- CVE-2021-0129: Fixed improper access control (bsc#1186463).\n- CVE-2021-3658: Fixed adapter incorrectly restoring discoverable state after powered down (bsc#1188859).\n- CVE-2021-43400: Fixed use-after-free in gatt-database.c (bsc#1192394).\n","status":"published","published":"2022-10-21T13:10:36Z","modified":"2026-02-04T02:52:01.889281Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"SUSE-SU-2022:3718-1","title":"Security update for bluez","description":"This update for bluez fixes the following issues:\n\n  - CVE-2019-8921: Fixed heap-based buffer overflow via crafted request (bsc#1193237).\n  - CVE-2016-9803: Fixed memory leak (bsc#1013885).\n\n","status":"published","published":"2022-10-25T08:19:03Z","modified":"2026-02-04T03:21:58.399454Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"USN-7265-1","title":"bluez vulnerabilities","description":"Julian Rauchberger discovered that BlueZ did not correctly handle certain\nmemory operations. An attacker could possibly use this issue to leak\nsensitive information or execute arbitrary code.\n(CVE-2019-8921, CVE-2019-8922)\n","status":"published","published":"2025-02-12T06:51:21Z","modified":"2026-06-25T13:32:30.09163392Z","updated_at":"2026-11-02T16:58:18.876384Z"}]}}