Every CVESearch/Get API key

CVE-2008-2374

src/sdp.c in bluez-libs 3.30 in BlueZ, and other bluez-libs before 3.34 and bluez-utils before 3...

7.5 HighFix available

CVE-2008-2374 is a high vulnerability (CVSS 7.5) in Bluez Bluez-libs, published July 7, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.29%, the 91st percentile. Fixed in bluez-libs 0:2.10-3.

What does this mean?
Severity
7.5 HighCVSS 2.0, NVD
Exploit chance
4.29%EPSS, 91st percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
0:2.10-3bluez-libs +38 more

Description

src/sdp.c in bluez-libs 3.30 in BlueZ, and other bluez-libs before 3.34 and bluez-utils before 3.34 versions, does not validate string length fields in SDP packets, which allows remote SDP servers to cause a denial of service or possibly have unspecified other impact via a crafted length field that triggers excessive memory allocation or a buffer over-read.

Exploit likelihood

4.29%Up 1.6 points since Feb 4, 2022
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
bluez-libs
Red Hat:enterprise_linux:4::as
before 0:2.10-3
0:2.10-3
bluez-libs-debuginfo
Red Hat:enterprise_linux:4::as
before 0:2.10-3
0:2.10-3
bluez-libs-devel
Red Hat:enterprise_linux:4::as
before 0:2.10-3
0:2.10-3
bluez-utils
Red Hat:enterprise_linux:4::as
before 0:2.10-2.4
0:2.10-2.4
bluez-utils-cups
Red Hat:enterprise_linux:4::as
before 0:2.10-2.4
0:2.10-2.4
bluez-utils-debuginfo
Red Hat:enterprise_linux:4::as
before 0:2.10-2.4
0:2.10-2.4
bluez-libs
Red Hat:enterprise_linux:4::desktop
before 0:2.10-3
0:2.10-3
bluez-libs-debuginfo
Red Hat:enterprise_linux:4::desktop
before 0:2.10-3
0:2.10-3
bluez-libs-devel
Red Hat:enterprise_linux:4::desktop
before 0:2.10-3
0:2.10-3
bluez-utils
Red Hat:enterprise_linux:4::desktop
before 0:2.10-2.4
0:2.10-2.4
Show 29 moreShow less
Affected packages
PackageAffectedFixed
bluez-utils-cups
Red Hat:enterprise_linux:4::desktop
before 0:2.10-2.4
0:2.10-2.4
bluez-utils-debuginfo
Red Hat:enterprise_linux:4::desktop
before 0:2.10-2.4
0:2.10-2.4
bluez-libs
Red Hat:enterprise_linux:4::es
before 0:2.10-3
0:2.10-3
bluez-libs-debuginfo
Red Hat:enterprise_linux:4::es
before 0:2.10-3
0:2.10-3
bluez-libs-devel
Red Hat:enterprise_linux:4::es
before 0:2.10-3
0:2.10-3
bluez-utils
Red Hat:enterprise_linux:4::es
before 0:2.10-2.4
0:2.10-2.4
bluez-utils-cups
Red Hat:enterprise_linux:4::es
before 0:2.10-2.4
0:2.10-2.4
bluez-utils-debuginfo
Red Hat:enterprise_linux:4::es
before 0:2.10-2.4
0:2.10-2.4
bluez-libs
Red Hat:enterprise_linux:4::ws
before 0:2.10-3
0:2.10-3
bluez-libs-debuginfo
Red Hat:enterprise_linux:4::ws
before 0:2.10-3
0:2.10-3
bluez-libs-devel
Red Hat:enterprise_linux:4::ws
before 0:2.10-3
0:2.10-3
bluez-utils
Red Hat:enterprise_linux:4::ws
before 0:2.10-2.4
0:2.10-2.4
bluez-utils-cups
Red Hat:enterprise_linux:4::ws
before 0:2.10-2.4
0:2.10-2.4
bluez-utils-debuginfo
Red Hat:enterprise_linux:4::ws
before 0:2.10-2.4
0:2.10-2.4
bluez-libs
Red Hat:enterprise_linux:5::client_workstation
before 0:3.7-1.1
0:3.7-1.1
bluez-libs-debuginfo
Red Hat:enterprise_linux:5::client_workstation
before 0:3.7-1.1
0:3.7-1.1
bluez-libs-devel
Red Hat:enterprise_linux:5::client_workstation
before 0:3.7-1.1
0:3.7-1.1
bluez-libs
Red Hat:enterprise_linux:5::client
before 0:3.7-1.1
0:3.7-1.1
bluez-libs-debuginfo
Red Hat:enterprise_linux:5::client
before 0:3.7-1.1
0:3.7-1.1
bluez-utils
Red Hat:enterprise_linux:5::client
before 0:3.7-2.2
0:3.7-2.2
bluez-utils-cups
Red Hat:enterprise_linux:5::client
before 0:3.7-2.2
0:3.7-2.2
bluez-utils-debuginfo
Red Hat:enterprise_linux:5::client
before 0:3.7-2.2
0:3.7-2.2
bluez-libs
Red Hat:enterprise_linux:5::server
before 0:3.7-1.1
0:3.7-1.1
bluez-libs-debuginfo
Red Hat:enterprise_linux:5::server
before 0:3.7-1.1
0:3.7-1.1
bluez-libs-devel
Red Hat:enterprise_linux:5::server
before 0:3.7-1.1
0:3.7-1.1
bluez-utils
Red Hat:enterprise_linux:5::server
before 0:3.7-2.2
0:3.7-2.2
bluez-utils-cups
Red Hat:enterprise_linux:5::server
before 0:3.7-2.2
0:3.7-2.2
bluez-utils-debuginfo
Red Hat:enterprise_linux:5::server
before 0:3.7-2.2
0:3.7-2.2
obex-data-server
openSUSE:Tumbleweed
before 0.4.6-15.8
0.4.6-15.8

What each source reports

CVE List9.8

src/sdp.c in bluez-libs 3.30 in BlueZ, and other bluez-libs before 3.34 and bluez-utils before 3.34 versions, does not validate string length fields in SDP packets, which allows remote SDP servers to cause a denial of service or possibly have unspecified other impact via a crafted length field that triggers excessive memory allocation or a buffer over-read.

Record
CVE-2008-2374
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-1284
Updated
2026-11-02
EUVDEUVD-2008-23699.8

src/sdp.c in bluez-libs 3.30 in BlueZ, and other bluez-libs before 3.34 and bluez-utils before 3.34 versions, does not validate string length fields in SDP packets, which allows remote SDP servers to cause a denial of service or possibly have unspecified other impact via a crafted length field that triggers excessive memory allocation or a buffer over-read.

Record
EUVD-2008-2369
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-03
GitHub AdvisoriesGHSA-278x-6vg6-6g429.8

src/sdp.c in bluez-libs 3.30 in BlueZ, and other bluez-libs before 3.34 and bluez-utils before 3...

src/sdp.c in bluez-libs 3.30 in BlueZ, and other bluez-libs before 3.34 and bluez-utils before 3.34 versions, does not validate string length fields in SDP packets, which allows remote SDP servers to cause a denial of service or possibly have unspecified other impact via a crafted length field that triggers excessive memory allocation or a buffer over-read.

Record
GHSA-278x-6vg6-6g42
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-20, CWE-1284
Updated
2026-11-02
NVD9.8

src/sdp.c in bluez-libs 3.30 in BlueZ, and other bluez-libs before 3.34 and bluez-utils before 3.34 versions, does not validate string length fields in SDP packets, which allows remote SDP servers to cause a denial of service or possibly have unspecified other impact via a crafted length field that triggers excessive memory allocation or a buffer over-read.

Record
CVE-2008-2374
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-1284
Updated
2026-11-02
OSVopenSUSE-SU-2024:10503-1No score

obex-data-server-0.4.6-15.8 on GA media

These are all security issues fixed in the obex-data-server-0.4.6-15.8 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10503-1
Updated
2026-11-02

History

History
RecordedChangedSources
facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 23 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open