Red Hat Enterprise Linux 8 update for bluez
| Risk | Low |
| Patch available | YES |
| Number of vulnerabilities | 2 |
| CVE-ID | CVE-2023-27349 CVE-2023-51589 |
| CWE-ID | CWE-119 CWE-125 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software |
Red Hat CodeReady Linux Builder for IBM z Systems Operating systems & Components / Operating system Red Hat CodeReady Linux Builder for ARM 64 Operating systems & Components / Operating system Red Hat CodeReady Linux Builder for Power, little endian Operating systems & Components / Operating system Red Hat CodeReady Linux Builder for x86_64 Operating systems & Components / Operating system Red Hat Enterprise Linux for ARM 64 Operating systems & Components / Operating system Red Hat Enterprise Linux for Power, little endian Operating systems & Components / Operating system Red Hat Enterprise Linux for IBM z Systems Operating systems & Components / Operating system Red Hat Enterprise Linux for x86_64 Operating systems & Components / Operating system bluez-libs-devel (Red Hat package) Operating systems & Components / Operating system package or component bluez-obexd-debuginfo (Red Hat package) Operating systems & Components / Operating system package or component bluez-libs-debuginfo (Red Hat package) Operating systems & Components / Operating system package or component bluez-hid2hci-debuginfo (Red Hat package) Operating systems & Components / Operating system package or component bluez-debugsource (Red Hat package) Operating systems & Components / Operating system package or component bluez-debuginfo (Red Hat package) Operating systems & Components / Operating system package or component bluez-cups-debuginfo (Red Hat package) Operating systems & Components / Operating system package or component bluez-cups (Red Hat package) Operating systems & Components / Operating system package or component |
| Vendor | Red Hat Inc. |
Security Bulletin
This security bulletin contains information about 2 vulnerabilities.
1) Buffer overflow
EUVDB-ID: #VU75105
Risk: Low
CVSSv4.0: 4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2023-27349
CWE-ID:
CWE-119 - Memory corruption
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error within the handling of the AVRCP protocol. A remote attacker with physical proximity to device can send specially crafted Bluetooth packets to the affected system, trigger memory corruption and execute arbitrary code on the system.
Mitigation
Install updates from vendor's website.
Red Hat CodeReady Linux Builder for IBM z Systems: 8.0
Red Hat CodeReady Linux Builder for ARM 64: 8.0
Red Hat CodeReady Linux Builder for Power, little endian: 8.0
Red Hat CodeReady Linux Builder for x86_64: 8.0
Red Hat Enterprise Linux for ARM 64: 8
Red Hat Enterprise Linux for Power, little endian: 8
Red Hat Enterprise Linux for IBM z Systems: 8
Red Hat Enterprise Linux for x86_64: 8.0
bluez-libs-devel (Red Hat package): before 5.63-5.el8_10
bluez-obexd-debuginfo (Red Hat package): before 5.63-5.el8_10
bluez-libs-debuginfo (Red Hat package): before 5.63-5.el8_10
bluez-hid2hci-debuginfo (Red Hat package): before 5.63-5.el8_10
bluez-debugsource (Red Hat package): before 5.63-5.el8_10
bluez-debuginfo (Red Hat package): before 5.63-5.el8_10
bluez-cups-debuginfo (Red Hat package): before 5.63-5.el8_10
bluez-cups (Red Hat package): before 5.63-5.el8_10
CPE2.3- cpe:2.3:o:red_hat:red_hat_codeready_linux_builder_for_ibm_z_systems:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:red_hat:red_hat_codeready_linux_builder_for_arm_64:8.0:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_codeready_linux_builder_for_power_little_endian:8.0:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_codeready_linux_builder_for_x86_64:8.0:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_enterprise_linux_for_arm_64:8:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_enterprise_linux_for_power_little_endian:8:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_enterprise_linux_for_ibm_z_systems:8:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_enterprise_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:a:red_hat:bluez-libs-devel_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:a:red_hat:bluez-obexd-debuginfo_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:a:red_hat:bluez-libs-debuginfo_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:a:red_hat:bluez-hid2hci-debuginfo_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:a:red_hat:bluez-debugsource_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:a:red_hat:bluez-debuginfo_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:a:red_hat:bluez-cups-debuginfo_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:a:red_hat:bluez-cups_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
https://access.redhat.com/errata/RHSA-2025:4043
Q & A
Can this vulnerability be exploited remotely?
No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Out-of-bounds read
EUVDB-ID: #VU84670
Risk: Low
CVSSv4.0: 0.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2023-51589
CWE-ID:
CWE-125 - Out-of-bounds read
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition when handling AVRCP protocol within the parse_media_element() function. A remote attacker can trick the victim into connecting to a malicious device, trigger an out-of-bounds read and gain access to sensitive information. MitigationInstall updates from vendor's website.
Red Hat CodeReady Linux Builder for IBM z Systems: 8.0
Red Hat CodeReady Linux Builder for ARM 64: 8.0
Red Hat CodeReady Linux Builder for Power, little endian: 8.0
Red Hat CodeReady Linux Builder for x86_64: 8.0
Red Hat Enterprise Linux for ARM 64: 8
Red Hat Enterprise Linux for Power, little endian: 8
Red Hat Enterprise Linux for IBM z Systems: 8
Red Hat Enterprise Linux for x86_64: 8.0
bluez-libs-devel (Red Hat package): before 5.63-5.el8_10
bluez-obexd-debuginfo (Red Hat package): before 5.63-5.el8_10
bluez-libs-debuginfo (Red Hat package): before 5.63-5.el8_10
bluez-hid2hci-debuginfo (Red Hat package): before 5.63-5.el8_10
bluez-debugsource (Red Hat package): before 5.63-5.el8_10
bluez-debuginfo (Red Hat package): before 5.63-5.el8_10
bluez-cups-debuginfo (Red Hat package): before 5.63-5.el8_10
bluez-cups (Red Hat package): before 5.63-5.el8_10
CPE2.3- cpe:2.3:o:red_hat:red_hat_codeready_linux_builder_for_ibm_z_systems:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:red_hat:red_hat_codeready_linux_builder_for_arm_64:8.0:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_codeready_linux_builder_for_power_little_endian:8.0:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_codeready_linux_builder_for_x86_64:8.0:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_enterprise_linux_for_arm_64:8:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_enterprise_linux_for_power_little_endian:8:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_enterprise_linux_for_ibm_z_systems:8:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_enterprise_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:a:red_hat:bluez-libs-devel_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:a:red_hat:bluez-obexd-debuginfo_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:a:red_hat:bluez-libs-debuginfo_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:a:red_hat:bluez-hid2hci-debuginfo_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:a:red_hat:bluez-debugsource_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:a:red_hat:bluez-debuginfo_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:a:red_hat:bluez-cups-debuginfo_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:a:red_hat:bluez-cups_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
https://access.redhat.com/errata/RHSA-2025:4043
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
