[USN-4989-2] BlueZ vulnerabilities

Severity Medium

Affected Packages 8

CVEs 2

Several security issues were fixed in BlueZ.

USN-4989-1 fixed several vulnerabilities in BlueZ. This update provides
the corresponding update for Ubuntu 16.04 ESM.

Original advisory details:

It was discovered that BlueZ incorrectly checked certain permissions when
pairing. A local attacker could possibly use this issue to impersonate
devices. (CVE-2020-26558)

Jay LV discovered that BlueZ incorrectly handled redundant disconnect MGMT
events. A local attacker could use this issue to cause BlueZ to crash,
resulting in a denial of service, or possibly execute arbitrary code. This
issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-27153)

Package	Affected Version
pkg:deb/ubuntu/libbluetooth3?distro=xenial	< 5.37-0ubuntu5.3+esm1
pkg:deb/ubuntu/libbluetooth-dev?distro=xenial	< 5.37-0ubuntu5.3+esm1
pkg:deb/ubuntu/bluez?distro=xenial	< 5.37-0ubuntu5.3+esm1
pkg:deb/ubuntu/bluez-tests?distro=xenial	< 5.37-0ubuntu5.3+esm1
pkg:deb/ubuntu/bluez-obexd?distro=xenial	< 5.37-0ubuntu5.3+esm1
pkg:deb/ubuntu/bluez-hcidump?distro=xenial	< 5.37-0ubuntu5.3+esm1
pkg:deb/ubuntu/bluez-cups?distro=xenial	< 5.37-0ubuntu5.3+esm1
pkg:deb/ubuntu/bluetooth?distro=xenial	< 5.37-0ubuntu5.3+esm1

ID

USN-4989-2

Severity

medium

URL

https://ubuntu.com/security/notices/USN-4989-2

Published

2021-06-16T14:17:40
(3 years ago)

Modified

2021-06-16T14:17:40
(3 years ago)

Other Advisories

Type	Package URL	Namespace	Name / Product	Version	Distribution / Platform
Affected	pkg:deb/ubuntu/libbluetooth3?distro=xenial	ubuntu	libbluetooth3	< 5.37-0ubuntu5.3+esm1	xenial
Affected	pkg:deb/ubuntu/libbluetooth-dev?distro=xenial	ubuntu	libbluetooth-dev	< 5.37-0ubuntu5.3+esm1	xenial
Affected	pkg:deb/ubuntu/bluez?distro=xenial	ubuntu	bluez	< 5.37-0ubuntu5.3+esm1	xenial
Affected	pkg:deb/ubuntu/bluez-tests?distro=xenial	ubuntu	bluez-tests	< 5.37-0ubuntu5.3+esm1	xenial
Affected	pkg:deb/ubuntu/bluez-obexd?distro=xenial	ubuntu	bluez-obexd	< 5.37-0ubuntu5.3+esm1	xenial
Affected	pkg:deb/ubuntu/bluez-hcidump?distro=xenial	ubuntu	bluez-hcidump	< 5.37-0ubuntu5.3+esm1	xenial
Affected	pkg:deb/ubuntu/bluez-cups?distro=xenial	ubuntu	bluez-cups	< 5.37-0ubuntu5.3+esm1	xenial
Affected	pkg:deb/ubuntu/bluetooth?distro=xenial	ubuntu	bluetooth	< 5.37-0ubuntu5.3+esm1	xenial

# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	Exploits	PoC	Pubblication Date	Modification Date
# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	PoC	Pubblication Date	Modification Date