CVE-2016-7837: Buffer Overflow

Reference Links

• http://www.securityfocus.com/bid/95067
• https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/?id=8514068150759c1d6a46d4605d2351babfde1601
• https://jvn.jp/en/jp/JVN38755305/index.html
• https://usn.ubuntu.com/4311-1/
• https://launchpad.net/bugs/cve/CVE-2016-7837
• http://git.kernel.org/cgit/bluetooth/bluez.git/commit/?id=8514068150759c1d6a46d4605d2351babfde1601
• https://security-tracker.debian.org/tracker/CVE-2016-7837
• https://ubuntu.com/security/notices/USN-4311-1
• https://www.cve.org/CVERecord?id=CVE-2016-7837
• https://nvd.nist.gov/vuln/detail/CVE-2016-7837
• https://ubuntu.com/security/CVE-2016-7837

Parent vulnerabilities

(Appears in the following advisories)

• USN-4311-1

Frequently Asked Questions

• What is the vulnerability ID of this issue?

  The vulnerability ID of this issue is CVE-2016-7837.

• What is the severity rating of CVE-2016-7837?

  The severity rating of CVE-2016-7837 is high with a score of 7.8.

• What is the affected software?

  The affected software is BlueZ versions 5.41 and earlier.

• How can an attacker exploit this vulnerability?

  An attacker can exploit this vulnerability by executing arbitrary code via the parse_line function used in some BlueZ userland utilities.

• How can I mitigate this vulnerability?

  To mitigate this vulnerability, update BlueZ to version 4.101-0ubuntu13.3 (for Ubuntu 14.04 Trusty), version 5.43-1 (for Ubuntu upstream), version 5.37-0ubuntu5.3 (for Ubuntu 16.04 Xenial), or a later version.