{"id":"CVE-2023-27349","aliases":["ALSA-2024:9413","ALSA-2025:4043","CLSA-2025-1754939879","CLSA-2025-1763031616","CLSA-2026-1788176031","DEBIAN-CVE-2023-27349","DLA-3820-1","DLA-3879-1","EUVD-2023-31125","GHSA-r3vg-5hjq-528v","OESA-2023-1249","RHSA-2024:9413","RHSA-2025:4043","RLSA-2024:9413","RLSA-2025:4043","SUSE-SU-2023:2533-1","SUSE-SU-2023:2545-1","SUSE-SU-2023:2546-1","SUSE-SU-2023:2562-1","SUSE-SU-2023:2605-1","SUSE-SU-2023:2613-1","UBUNTU-CVE-2023-27349","USN-6809-1","openSUSE-SU-2024:13128-1"],"status":"published","title":"BlueZ Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability","description":"BlueZ Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious device.\n\nThe specific flaw exists within the handling of the AVRCP protocol. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-19908.","severity":{"version":"3.0","score":7.1,"vector":"CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.01427,"percentile":0.7332,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-129"],"published":"2023-04-21T11:05:43Z","modified":"2026-10-29T11:31:53Z","fixes":[{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"bluez","fixed_in":["5.64-2.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"bluez-cups","fixed_in":["5.64-2.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"bluez-hid2hci","fixed_in":["5.64-2.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"bluez-libs","fixed_in":["5.64-2.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"bluez-libs-devel","fixed_in":["5.64-2.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"bluez-mesh","fixed_in":["5.64-2.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"bluez-obexd","fixed_in":["5.64-2.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"bluetooth","fixed_in":["5.48-0ubuntu3.9+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"bluez","fixed_in":["5.48-0ubuntu3.9+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"bluez-cups","fixed_in":["5.48-0ubuntu3.9+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"bluez-hcidump","fixed_in":["5.48-0ubuntu3.9+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"bluez-obexd","fixed_in":["5.48-0ubuntu3.9+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"bluez-tests","fixed_in":["5.48-0ubuntu3.9+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libbluetooth-dev","fixed_in":["5.48-0ubuntu3.9+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libbluetooth3","fixed_in":["5.48-0ubuntu3.9+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"bluez","fixed_in":["5.66-1+deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"bluez","fixed_in":["5.68-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"bluez","fixed_in":["5.68-1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"bluez","fixed_in":["5.50-1.2~deb10u5"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"bluez","fixed_in":["5.54-12.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"bluez","fixed_in":["5.54-12.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"bluez","fixed_in":["5.54-17.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"bluez","fixed_in":["5.54-17.oe2203sp1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"bluez","fixed_in":["5.48-150000.5.49.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"bluez","fixed_in":["5.48-150000.5.49.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"bluez","fixed_in":["5.48-150000.5.49.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"bluez","fixed_in":["5.48-150200.13.25.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"bluez","fixed_in":["5.48-150200.13.25.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"bluez","fixed_in":["5.48-150200.13.25.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7","package":"bluez","fixed_in":["5.48-150200.13.25.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"bluez","fixed_in":["5.65-150500.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP5","package":"bluez","fixed_in":["5.65-150500.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP5","package":"bluez","fixed_in":["5.65-150500.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"bluez","fixed_in":["5.65-150500.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 9","package":"bluez","fixed_in":["5.13-5.39.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"bluez","fixed_in":["5.13-5.39.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"bluez","fixed_in":["5.13-5.39.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"bluez","fixed_in":["5.13-5.39.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"bluez","fixed_in":["5.13-5.39.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP4-ESPOS","package":"bluez","fixed_in":["5.13-5.39.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"bluez","fixed_in":["5.13-5.39.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"bluez","fixed_in":["5.13-5.39.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"bluez","fixed_in":["5.13-5.39.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP5","package":"bluez","fixed_in":["5.13-5.39.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"bluez","fixed_in":["5.62-150400.4.13.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"bluez","fixed_in":["5.62-150400.4.13.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"bluez","fixed_in":["5.62-150400.4.13.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP4","package":"bluez","fixed_in":["5.62-150400.4.13.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP4","package":"bluez","fixed_in":["5.62-150400.4.13.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap Micro 5.3","package":"bluez","fixed_in":["5.62-150400.4.13.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"bluez","fixed_in":["5.62-150400.4.13.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"bluez","fixed_in":["5.55-150300.3.22.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"bluez","fixed_in":["5.55-150300.3.22.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Real Time 15 SP3","package":"bluez","fixed_in":["5.55-150300.3.22.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"bluez","fixed_in":["5.55-150300.3.22.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"bluez","fixed_in":["5.55-150300.3.22.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.2","package":"bluez","fixed_in":["5.55-150300.3.22.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.2","package":"bluez","fixed_in":["5.55-150300.3.22.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7.1","package":"bluez","fixed_in":["5.55-150300.3.22.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"bluez","fixed_in":["5.37-0ubuntu5.3+esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"bluez","fixed_in":["5.48-0ubuntu3.9+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"bluez","fixed_in":["5.53-0ubuntu3.8"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"bluez","fixed_in":["5.64-0ubuntu1.3"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"bluez","fixed_in":["5.68-2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:9","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.72-2.el9"}]}],"bundled":10},{"source":"osv","ecosystem":"AlmaLinux:9","package":"bluez-cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.72-2.el9"}]}],"bundled":10},{"source":"osv","ecosystem":"AlmaLinux:9","package":"bluez-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.72-2.el9"}]}],"bundled":10},{"source":"osv","ecosystem":"AlmaLinux:9","package":"bluez-libs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.72-2.el9"}]}],"bundled":10},{"source":"osv","ecosystem":"AlmaLinux:9","package":"bluez-obexd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.72-2.el9"}]}],"bundled":10},{"source":"osv","ecosystem":"AlmaLinux:8","package":"bluez-cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.63-5.el8_10.alma.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"bluez-libs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.63-5.el8_10.alma.1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.64-2.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"bluez-cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.64-2.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"bluez-hid2hci","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.64-2.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"bluez-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.64-2.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"bluez-libs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.64-2.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"bluez-mesh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.64-2.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"bluez-obexd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.64-2.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.72-4.el9.tuxcare.els1"}]}],"bundled":10},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"bluez-cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.72-4.el9.tuxcare.els1"}]}],"bundled":10},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"bluez-hid2hci","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.72-4.el9.tuxcare.els1"}]}],"bundled":10},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"bluez-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.72-4.el9.tuxcare.els1"}]}],"bundled":10},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"bluez-libs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.72-4.el9.tuxcare.els1"}]}],"bundled":10},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"bluez-mesh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.72-4.el9.tuxcare.els1"}]}],"bundled":10},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"bluez-obexd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.72-4.el9.tuxcare.els1"}]}],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"bluetooth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.48-0ubuntu3.9+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.48-0ubuntu3.9+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"bluez-cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.48-0ubuntu3.9+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"bluez-hcidump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.48-0ubuntu3.9+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"bluez-obexd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.48-0ubuntu3.9+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"bluez-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.48-0ubuntu3.9+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libbluetooth-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.48-0ubuntu3.9+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libbluetooth3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.48-0ubuntu3.9+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.66-1+deb12u2"}]}],"versions":["5.66-1","5.66-1+deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.68-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.68-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.50-1.2~deb10u5"}]}],"versions":["5.50-1","5.50-1.1","5.50-1.2~deb10u1","5.50-1.2~deb10u2","5.50-1.2~deb10u3","5.50-1.2~deb10u4"]},{"source":"osv","ecosystem":"Debian:11","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.55-3.1+deb11u2"}]}],"versions":["5.55-3.1","5.55-3.1+deb11u1"],"bundled":9},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.54-12.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.54-12.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.54-17.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.54-17.oe2203sp1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"bluez-cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.72-2.el9"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"bluez-cups-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.72-2.el9"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"bluez-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.72-2.el9"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"bluez-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.72-2.el9"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"bluez-hid2hci-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.72-2.el9"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"bluez-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.72-2.el9"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"bluez-libs-devel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.72-2.el9"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"bluez-mesh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.72-2.el9"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"bluez-obexd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.72-2.el9"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"bluez-obexd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.72-2.el9"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.72-2.el9"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"bluez-cups-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.72-2.el9"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"bluez-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.72-2.el9"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"bluez-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.72-2.el9"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"bluez-hid2hci-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.72-2.el9"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"bluez-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.72-2.el9"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"bluez-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.72-2.el9"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"bluez-libs-devel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.72-2.el9"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"bluez-mesh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.72-2.el9"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"bluez-obexd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.72-2.el9"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"bluez-cups-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.72-2.el9"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"bluez-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.72-2.el9"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"bluez-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.72-2.el9"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"bluez-hid2hci-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.72-2.el9"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"bluez-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.72-2.el9"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"bluez-libs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.72-2.el9"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"bluez-libs-devel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.72-2.el9"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"bluez-mesh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.72-2.el9"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"bluez-obexd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.72-2.el9"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"bluez-cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.63-5.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"bluez-cups-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.63-5.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"bluez-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.63-5.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"bluez-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.63-5.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"bluez-hid2hci-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.63-5.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"bluez-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.63-5.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"bluez-obexd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.63-5.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.63-5.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"bluez-cups-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.63-5.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"bluez-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.63-5.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"bluez-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.63-5.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"bluez-hid2hci","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.63-5.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"bluez-hid2hci-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.63-5.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"bluez-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.63-5.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"bluez-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.63-5.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"bluez-obexd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.63-5.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"bluez-obexd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.63-5.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"bluez-cups-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.63-5.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"bluez-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.63-5.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"bluez-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.63-5.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"bluez-hid2hci-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.63-5.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"bluez-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.63-5.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"bluez-libs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.63-5.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"bluez-obexd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.63-5.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.72-2.el9"}]}],"bundled":10},{"source":"osv","ecosystem":"Rocky Linux:8","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.63-5.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.48-150000.5.49.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.48-150000.5.49.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.48-150000.5.49.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.48-150200.13.25.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.48-150200.13.25.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.48-150200.13.25.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.48-150200.13.25.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.65-150500.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP5","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.65-150500.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP5","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.65-150500.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.65-150500.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.13-5.39.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.13-5.39.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.13-5.39.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.13-5.39.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.13-5.39.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-ESPOS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.13-5.39.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.13-5.39.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.13-5.39.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.13-5.39.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP5","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.13-5.39.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.62-150400.4.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.62-150400.4.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.62-150400.4.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP4","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.62-150400.4.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP4","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.62-150400.4.13.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.3","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.62-150400.4.13.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.62-150400.4.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.55-150300.3.22.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.55-150300.3.22.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 15 SP3","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.55-150300.3.22.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.55-150300.3.22.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.55-150300.3.22.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.2","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.55-150300.3.22.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.2","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.55-150300.3.22.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.55-150300.3.22.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.37-0ubuntu5.3+esm4"}]}],"versions":["5.35-0ubuntu2","5.36-0ubuntu1","5.37-0ubuntu5","5.37-0ubuntu5.1","5.37-0ubuntu5.3","5.37-0ubuntu5.3+esm1","5.37-0ubuntu5.3+esm2","5.37-0ubuntu5.3+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.48-0ubuntu3.9+esm2"}]}],"versions":["5.46-0ubuntu3","5.46-0ubuntu4","5.48-0ubuntu3","5.48-0ubuntu3.1","5.48-0ubuntu3.2","5.48-0ubuntu3.3","5.48-0ubuntu3.4","5.48-0ubuntu3.5","5.48-0ubuntu3.6","5.48-0ubuntu3.7","5.48-0ubuntu3.8","5.48-0ubuntu3.9","5.48-0ubuntu3.9+esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.53-0ubuntu3.8"}]}],"versions":["5.50-0ubuntu4","5.51-0ubuntu1","5.51-0ubuntu2","5.52-0ubuntu1","5.52-0ubuntu2","5.53-0ubuntu1","5.53-0ubuntu2","5.53-0ubuntu3","5.53-0ubuntu3.1","5.53-0ubuntu3.2","5.53-0ubuntu3.3","5.53-0ubuntu3.4","5.53-0ubuntu3.5","5.53-0ubuntu3.6","5.53-0ubuntu3.7"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.64-0ubuntu1.3"}]}],"versions":["5.60-0ubuntu2","5.62-0ubuntu1","5.62-0ubuntu2","5.63-0ubuntu1","5.63-0ubuntu2","5.64-0ubuntu1","5.64-0ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.37-0ubuntu5.3+esm4"}]}],"versions":["5.35-0ubuntu2","5.36-0ubuntu1","5.37-0ubuntu5","5.37-0ubuntu5.1","5.37-0ubuntu5.3","5.37-0ubuntu5.3+esm1","5.37-0ubuntu5.3+esm2","5.37-0ubuntu5.3+esm3"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.48-0ubuntu3.9+esm2"}]}],"versions":["5.46-0ubuntu3","5.46-0ubuntu4","5.48-0ubuntu3","5.48-0ubuntu3.1","5.48-0ubuntu3.2","5.48-0ubuntu3.3","5.48-0ubuntu3.4","5.48-0ubuntu3.5","5.48-0ubuntu3.6","5.48-0ubuntu3.7","5.48-0ubuntu3.8","5.48-0ubuntu3.9","5.48-0ubuntu3.9+esm1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.53-0ubuntu3.8"}]}],"versions":["5.50-0ubuntu4","5.51-0ubuntu1","5.51-0ubuntu2","5.52-0ubuntu1","5.52-0ubuntu2","5.53-0ubuntu1","5.53-0ubuntu2","5.53-0ubuntu3","5.53-0ubuntu3.1","5.53-0ubuntu3.2","5.53-0ubuntu3.3","5.53-0ubuntu3.4","5.53-0ubuntu3.5","5.53-0ubuntu3.6","5.53-0ubuntu3.7"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.64-0ubuntu1.3"}]}],"versions":["5.60-0ubuntu2","5.62-0ubuntu1","5.62-0ubuntu2","5.63-0ubuntu1","5.63-0ubuntu2","5.64-0ubuntu1","5.64-0ubuntu1.1"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.68-2.1"}]}]}],"products":[{"vendor":"bluez","product":"bluez"}],"references":[{"url":"https://www.zerodayinitiative.com/advisories/ZDI-23-386/","tags":["x_research-advisory","x_transferred","Third Party Advisory","advisory","article","report"]},{"url":"https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/?id=f54299a850676d92c3dafd83e9174fcfe420ccc9","tags":["vendor-advisory","x_transferred","Patch","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/05/msg00015.html","tags":["x_transferred","Third Party Advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/09/msg00022.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-27349","tags":["advisory"]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-23-386"},{"url":"https://github.com/advisories/GHSA-r3vg-5hjq-528v"},{"url":"https://access.redhat.com/errata/RHSA-2024:9413","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-27349","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-44431","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-45866","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-50229","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-50230","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-51580","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-51589","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-51592","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-51594","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-51596","tags":["report"]},{"url":"https://bugzilla.redhat.com/2253391","tags":["report"]},{"url":"https://bugzilla.redhat.com/2278787","tags":["report"]},{"url":"https://bugzilla.redhat.com/2278945","tags":["report"]},{"url":"https://bugzilla.redhat.com/2278955","tags":["report"]},{"url":"https://bugzilla.redhat.com/2278962","tags":["report"]},{"url":"https://bugzilla.redhat.com/2278965","tags":["report"]},{"url":"https://bugzilla.redhat.com/2278967","tags":["report"]},{"url":"https://bugzilla.redhat.com/2278969","tags":["report"]},{"url":"https://bugzilla.redhat.com/2278972","tags":["report"]},{"url":"https://bugzilla.redhat.com/2278974","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2024-9413.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:4043","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2025-4043.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2025-1754939879.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2025-1763031616.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1788176031.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/27xxx/CVE-2023-27349.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-27349","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1249","tags":["advisory"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/9.5_release_notes/index","tags":["article"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2253391","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2278787","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2278945","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2278955","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2278962","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2278965","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2278967","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2278969","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2278972","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2278974","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_9413.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-27349","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-44431","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-44431","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-45866","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-45866","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-50229","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-50229","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-50230","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-50230","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-51580","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-51580","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-51589","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-51589","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-51592","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-51592","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-51594","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-51594","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-51596","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-51596","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_4043.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:9413","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:4043","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232533-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1210398","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-27349","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232545-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232546-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232562-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232605-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232613-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-27349","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6809-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-3563","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-27349","title":"BlueZ Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability","description":"BlueZ Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious device.\n\nThe specific flaw exists within the handling of the AVRCP protocol. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-19908.","status":"published","published":"2024-05-03T01:56:08.23Z","modified":"2025-11-04T16:10:00.724Z","cvss":[{"version":"3.0","score":7.1,"vector":"CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-129"],"updated_at":"2026-11-02T14:35:26.63732Z"}],"euvd":[{"id":"EUVD-2023-31125","description":"BlueZ Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious device.\n\nThe specific flaw exists within the handling of the AVRCP protocol. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-19908.","status":"published","published":"2024-05-03T01:56:08Z","modified":"2025-11-04T16:10:00Z","cvss":[{"version":"3.0","score":7.1,"vector":"CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:49:29.391161Z"}],"ghsa":[{"id":"GHSA-r3vg-5hjq-528v","title":"BlueZ Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability....","description":"BlueZ Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious device.\n\nThe specific flaw exists within the handling of the AVRCP protocol. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-19908.","status":"published","published":"2024-05-03T03:30:49Z","modified":"2025-11-04T18:31:57Z","cvss":[{"version":"3.0","score":7.1,"vector":"CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-129"],"updated_at":"2026-11-02T15:04:34.447716Z"}],"nvd":[{"id":"CVE-2023-27349","description":"BlueZ Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious device.\n\nThe specific flaw exists within the handling of the AVRCP protocol. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-19908.","status":"published","published":"2024-05-03T02:15:13.14Z","modified":"2026-06-17T05:44:50.817Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.0","score":7.1,"vector":"CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-129"],"updated_at":"2026-11-02T14:09:11.362739Z"}],"osv":[{"id":"CVE-2023-27349","title":"BlueZ Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability","description":"BlueZ Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious device.\n\nThe specific flaw exists within the handling of the AVRCP protocol. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-19908.","status":"published","published":"2024-05-03T01:56:08.23Z","modified":"2026-10-28T02:30:32.841887814Z","cvss":[{"version":"3.0","score":7.1,"vector":"CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-129"],"updated_at":"2026-11-02T15:44:31.135751Z"},{"id":"DEBIAN-CVE-2023-27349","description":"BlueZ Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious device.  The specific flaw exists within the handling of the AVRCP protocol. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-19908.","status":"published","published":"2024-05-03T02:15:13.14Z","modified":"2026-10-26T18:01:22.709236561Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:39.679062Z"},{"id":"OESA-2023-1249","title":"bluez security update","description":"This package provides all utilities for use in Bluetooth applications. The BLUETOOTH trademarks are owned by Bluetooth SIG, Inc., U.S.A.\r\n\r\nSecurity Fix(es):\r\n\r\n(CVE-2023-27349)","status":"published","published":"2023-04-21T11:05:43Z","modified":"2026-08-18T01:17:41.335127923Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:39.934788Z"},{"id":"RHSA-2024:9413","title":"Red Hat Security Advisory: bluez security update","status":"published","published":"2024-11-12T18:06:36Z","modified":"2026-08-07T10:16:43Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:14.610978Z"},{"id":"RHSA-2025:4043","title":"Red Hat Security Advisory: bluez security update","status":"published","published":"2025-04-24T10:03:51Z","modified":"2026-08-07T10:20:07Z","cvss":[{"version":"3.0","score":7.1,"vector":"CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:17.133041Z"},{"id":"RLSA-2025:4043","title":"Moderate: bluez security update","description":"The bluez packages contain the following utilities for use in Bluetooth applications: hcitool, hciattach, hciconfig, bluetoothd, l2ping, start scripts (Rocky Enterprise Software Foundation), and pcmcia configuration files. \n\nSecurity Fix(es):\n\n* BlueZ: Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability (CVE-2023-27349)\n\n* bluez: audio profile avrcp parse_media_element out-of-bounds read information disclosure vulnerability (CVE-2023-51589)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-07-29T13:38:26.98262Z","modified":"2025-07-29T14:59:55.919185Z","cvss":[{"version":"3.0","score":7.1,"vector":"CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.216873Z"},{"id":"UBUNTU-CVE-2023-27349","description":"BlueZ Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious device. The specific flaw exists within the handling of the AVRCP protocol. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-19908.","status":"published","published":"2024-05-03T02:15:00Z","modified":"2026-04-22T14:04:32.436985Z","cvss":[{"version":"3.0","score":7.1,"vector":"CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:20.198616Z"},{"id":"ALSA-2024:9413","title":"Moderate: bluez security update","description":"The bluez packages contain the following utilities for use in Bluetooth applications: hcitool, hciattach, hciconfig, bluetoothd, l2ping, start scripts (AlmaLinux), and pcmcia configuration files.   \n\nSecurity Fix(es):  \n\n  * bluez: unauthorized HID device connections allows keystroke injection and arbitrary commands execution (CVE-2023-45866)\n  * BlueZ: Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability (CVE-2023-27349)\n  * bluez: phone book access profile heap-based buffer overflow remote code execution vulnerability (CVE-2023-51596)\n  * bluez: OBEX library out-of-bounds read information disclosure vulnerability (CVE-2023-51594)\n  * bluez: audio profile avrcp parse_media_folder out-of-bounds read information disclosure vulnerability (CVE-2023-51592)\n  * bluez: audio profile avrcp parse_media_element out-of-bounds read information disclosure vulnerability (CVE-2023-51589)\n  * bluez: avrcp_parse_attribute_list out-of-bounds read information disclosure vulnerability (CVE-2023-51580)\n  * bluez: AVRCP stack-based buffer overflow remote code execution vulnerability (CVE-2023-44431)\n  * bluez: phone book access profile heap-based buffer overflow remote code execution vulnerability (CVE-2023-50230)\n  * bluez: phone book access profile heap-based buffer overflow remote code execution vulnerability (CVE-2023-50229)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.  \n\nAdditional Changes:  \n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.\n","status":"published","published":"2024-11-12T00:00:00Z","modified":"2026-10-29T11:31:53.920798667Z","updated_at":"2026-11-02T15:27:53.030731Z"},{"id":"ALSA-2025:4043","title":"Moderate: bluez security update","description":"The bluez packages contain the following utilities for use in Bluetooth applications: hcitool, hciattach, hciconfig, bluetoothd, l2ping, start scripts (AlmaLinux), and pcmcia configuration files.   \n\nSecurity Fix(es):  \n\n  * BlueZ: Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability (CVE-2023-27349)\n  * bluez: audio profile avrcp parse_media_element out-of-bounds read information disclosure vulnerability (CVE-2023-51589)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-04-22T00:00:00Z","modified":"2026-10-29T11:02:23.059242406Z","updated_at":"2026-11-02T15:27:53.448565Z"},{"id":"CLSA-2025-1754939879","title":"bluez: Fix of CVE-2023-27349","description":"- CVE-2023-27349: fix crash while handling unsupported\n  events in avrcp","status":"published","published":"2025-08-11T19:18:02Z","modified":"2026-06-01T00:31:11.579686642Z","updated_at":"2026-11-02T15:43:42.025438Z"},{"id":"CLSA-2025-1763031616","title":"bluez: Fix of 10 CVEs","description":"- CVE-2023-27349: fix crash while handling unsupported events in avrcp\n- CVE-2023-44431: fix Stack-based buffer overflow and remote code execution\n  vulnerability\n- CVE-2023-45866: restrict HID connections to avoid unauthorized input injection\n- CVE-2023-50229: fix heap-based buffer overflow vulnerability in handling Phone\n  Book Access profile by adding proper validation of user-supplied data length\n  before copying to buffer\n- CVE-2023-50230: fix heap-based buffer overflow vulnerability in Phone Book\n  Access profile to prevent arbitrary code execution by validating user-supplied\n  data length before copying to buffer\n- CVE-2023-51580: validate AVRCP attribute list data to prevent out-of-bounds\n  reads and information disclosure\n- CVE-2023-51589: validate AVRCP media element data to prevent out-of-bounds\n  reads and information disclosure\n- CVE-2023-51592: validate AVRCP media folder data to prevent out-of-bounds\n  reads and information disclosure\n- CVE-2023-51594: validate OBEX protocol parameters to prevent out-of-bounds\n  reads and information disclosure\n- CVE-2023-51596: validate PBAP data length to prevent heap overflow and remote\n  code execution","status":"published","published":"2025-11-13T11:00:20Z","modified":"2026-06-01T00:31:25.253544213Z","updated_at":"2026-11-02T15:43:42.427288Z"},{"id":"CLSA-2026-1788176031","title":"Fix CVE(s): CVE-2023-27349","description":"   * SECURITY UPDATE: out-of-bounds write via an unsupported AVRCP event\n     - debian/patches/CVE-2023-27349.patch: reject an event id above\n       AVRCP_EVENT_LAST in avrcp_handle_event() before it is used to index\n       session-\u003etransaction_events, a 14-entry array (upstream f54299a850).\n     - CVE-2023-27349","status":"published","published":"2026-08-31T11:34:02Z","modified":"2026-10-26T09:32:04.277705269Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"DLA-3820-1","title":"bluez - security update","status":"published","published":"2024-05-25T00:00:00Z","modified":"2026-03-09T01:21:01.971043Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"DLA-3879-1","title":"bluez - security update","status":"published","published":"2024-09-07T00:00:00Z","modified":"2026-03-09T01:18:30.227025Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"openSUSE-SU-2024:13128-1","title":"bluez-5.68-2.1 on GA media","description":"These are all security issues fixed in the bluez-5.68-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:54:42.607753Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"RLSA-2024:9413","title":"Moderate: bluez security update","description":"The bluez packages contain the following utilities for use in Bluetooth applications: hcitool, hciattach, hciconfig, bluetoothd, l2ping, start scripts (Rocky Enterprise Software Foundation), and pcmcia configuration files. \n\nSecurity Fix(es):\n\n* bluez: unauthorized HID device connections allows keystroke injection and arbitrary commands execution (CVE-2023-45866)\n\n* BlueZ: Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability (CVE-2023-27349)\n\n* bluez: phone book access profile heap-based buffer overflow remote code execution vulnerability (CVE-2023-51596)\n\n* bluez: OBEX library out-of-bounds read information disclosure vulnerability (CVE-2023-51594)\n\n* bluez: audio profile avrcp parse_media_folder out-of-bounds read information disclosure vulnerability (CVE-2023-51592)\n\n* bluez: audio profile avrcp parse_media_element out-of-bounds read information disclosure vulnerability (CVE-2023-51589)\n\n* bluez: avrcp_parse_attribute_list out-of-bounds read information disclosure vulnerability (CVE-2023-51580)\n\n* bluez: AVRCP stack-based buffer overflow remote code execution vulnerability (CVE-2023-44431)\n\n* bluez: phone book access profile heap-based buffer overflow remote code execution vulnerability (CVE-2023-50230)\n\n* bluez: phone book access profile heap-based buffer overflow remote code execution vulnerability (CVE-2023-50229)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 9.5 Release Notes linked from the References section.","status":"published","published":"2025-03-17T20:16:43.608626Z","modified":"2026-02-05T13:30:14.532983Z","updated_at":"2026-11-02T15:53:24.923365Z"},{"id":"SUSE-SU-2023:2533-1","title":"Security update for bluez","description":"This update for bluez fixes the following issues:\n\n- CVE-2023-27349: Fixed crash while handling unsupported events (bsc#1210398).\n","status":"published","published":"2023-06-19T07:49:58Z","modified":"2026-02-04T04:36:25.178884Z","updated_at":"2026-11-02T15:53:53.019382Z"},{"id":"SUSE-SU-2023:2545-1","title":"Security update for bluez","description":"This update for bluez fixes the following issues:\n\n- CVE-2023-27349: Fixed crash while handling unsupported events (bsc#1210398).\n","status":"published","published":"2023-06-19T11:08:44Z","modified":"2026-02-04T04:10:02.088459Z","updated_at":"2026-11-02T15:53:53.019382Z"},{"id":"SUSE-SU-2023:2546-1","title":"Security update for bluez","description":"This update for bluez fixes the following issues:\n\n- CVE-2023-27349: Fixed crash while handling unsupported events (bsc#1210398).\n","status":"published","published":"2023-06-19T11:09:07Z","modified":"2026-02-04T02:20:33.619875Z","updated_at":"2026-11-02T15:53:53.019382Z"},{"id":"SUSE-SU-2023:2562-1","title":"Security update for bluez","description":"This update for bluez fixes the following issues:\n\n- CVE-2023-27349: Fixed crash while handling unsupported events (bsc#1210398).\n","status":"published","published":"2023-06-21T09:20:58Z","modified":"2026-02-04T04:31:34.520927Z","updated_at":"2026-11-02T15:53:53.019382Z"},{"id":"SUSE-SU-2023:2605-1","title":"Security update for bluez","description":"This update for bluez fixes the following issues:\n\n- CVE-2023-27349: Fixed crash while handling unsupported events (bsc#1210398).\n","status":"published","published":"2023-06-22T07:49:52Z","modified":"2026-02-04T04:08:21.870447Z","updated_at":"2026-11-02T15:53:53.019382Z"},{"id":"SUSE-SU-2023:2613-1","title":"Security update for bluez","description":"This update for bluez fixes the following issues:\n\n- CVE-2023-27349: Fixed crash while handling unsupported events (bsc#1210398).\n","status":"published","published":"2023-06-22T11:59:01Z","modified":"2026-02-04T03:14:13.993403Z","updated_at":"2026-11-02T15:53:53.019382Z"},{"id":"USN-6809-1","title":"bluez vulnerabilities","description":"It was discovered that BlueZ could be made to dereference invalid memory.\nAn attacker could possibly use this issue to cause a denial of service.\nThis issue only affected Ubuntu 22.04 LTS. (CVE-2022-3563)\n\nIt was discovered that BlueZ could be made to write out of bounds. If a\nuser were tricked into connecting to a malicious device, an attacker could\npossibly use this issue to cause a denial of service or execute arbitrary\ncode. (CVE-2023-27349)\n","status":"published","published":"2024-06-05T19:56:58Z","modified":"2026-06-25T13:32:28.934880798Z","updated_at":"2026-11-02T16:58:17.914523Z"}]}}