| Summary | BlueZ Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious device. The specific flaw exists within the handling of the AVRCP protocol. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-19908. |
|---|---|
| Publication Date | May 3, 2024, 11:15 a.m. |
| Registration Date | May 3, 2024, 4:04 p.m. |
| Last Update | Nov. 21, 2024, 4:52 p.m. |
| Title | BlueZ Project の BlueZ における配列インデックスの検証に関する脆弱性 |
|---|---|
| Summary | BlueZ Project の BlueZ には、配列インデックスの検証に関する脆弱性が存在します。 |
| Possible impacts | 情報を取得される、情報を改ざんされる、およびサービス運用妨害 (DoS) 状態にされる可能性があります。 |
| Solution | ベンダアドバイザリまたはパッチ情報が公開されています。参考情報を参照して適切な対策を実施してください。 |
| Publication Date | Feb. 28, 2023, midnight |
| Registration Date | July 9, 2025, 2:42 p.m. |
| Last Update | July 9, 2025, 2:42 p.m. |
| BlueZ Project |
| BlueZ 5.66 |
| No | Changed Details | Date of change |
|---|---|---|
| 1 | [2025年07月09日] 掲載 |
July 9, 2025, 2:42 p.m. |