CVE-2018-10910
First published: Fri Jul 20 2018(Updated: )
A bug in Bluez may allow for the Bluetooth Discoverable state being set to on when no Bluetooth agent is registered with the system. This situation could lead to the unauthorized pairing of certain Bluetooth devices without any form of authentication. Versions before bluez 5.51 are vulnerable.
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| BlueZ BlueZ | <5.51 | |
| Canonical Ubuntu Linux | =18.04 | |
| ubuntu/bluez | <5.51 | 5.51 |
| ubuntu/gnome-bluetooth | <3.28.0-2ubuntu0.1 | 3.28.0-2ubuntu0.1 |
| ubuntu/gnome-bluetooth | <3.28.1 | 3.28.1 |
| debian/bluez | 5.55-3.1+deb11u1 5.66-1+deb12u2 5.66-1+deb12u1 5.73-1.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10910
- https://usn.ubuntu.com/3856-1/
- https://launchpad.net/bugs/cve/CVE-2018-10910
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1602985
- https://gitlab.gnome.org/GNOME/gnome-bluetooth/commit/6b5086d42ea64d46277f3c93b43984f331d12f89
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1606371
- https://access.redhat.com/errata/RHSA-2020:1101
- https://access.redhat.com/security/cve/cve-2018-10910
- https://access.redhat.com/errata/RHSA-2020:1912
- https://bugzilla.redhat.com/show_bug.cgi?id=1606203
- https://bugzilla.redhat.com/show_bug.cgi?id=1602985
- https://security-tracker.debian.org/tracker/CVE-2018-10910
- https://ubuntu.com/security/notices/USN-3856-1
- https://www.cve.org/CVERecord?id=CVE-2018-10910
- https://nvd.nist.gov/vuln/detail/CVE-2018-10910
- https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/?id=2796d545e82659541333050557d5dbb89a295ae7
- https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/?id=ee863d9d5dd45b183ba6b0b45455498cd88b8663
- https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/?id=6324acf2012ec444f67c73a42d3991064a69eec6
- https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/?id=45969a7a7335eaa47c52b76b9e32c28d680dc031
- https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/?id=bbf1cd0102a4de658ca596dddb48713124f1fd41
- https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/?id=d04eb02f9bad8795297210ef80e262be16ea8f07
- https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/?id=170ff3b81fdd9902c0b41bfd37ea0090cdb22830
- https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/?id=9a57d90628224fa6525e4eebf1e97f713918bb3b
- https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/?id=4f162b557a963cc21f7f1933e9abf3876f283b38
- https://ubuntu.com/security/CVE-2018-10910
Frequently Asked Questions
What is CVE-2018-10910?
CVE-2018-10910 is a vulnerability in Bluez that allows for the Bluetooth Discoverable state to be set to on when no Bluetooth agent is registered with the system, potentially leading to unauthorized pairing of Bluetooth devices.
Which versions of Bluez are vulnerable to CVE-2018-10910?
Versions before Bluez 5.51 are vulnerable to CVE-2018-10910.
What is the severity of CVE-2018-10910?
The severity of CVE-2018-10910 is medium with a severity value of 3.3.
How can I fix CVE-2018-10910?
To fix CVE-2018-10910, update Bluez to version 5.51 or higher.
Where can I find more information about CVE-2018-10910?
You can find more information about CVE-2018-10910 on the Red Hat Bugzilla and Ubuntu security advisories.
- collector/nvd-index
- agent/type
- agent/first-publish-date
- collector/launchpad-cve
- source/Launchpad
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2018-10910
- agent/author
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup
- agent/remedy
- agent/description
- agent/weakness
- agent/references
- collector/security-tracker-debian
- source/Debian
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/severity
- agent/tags
- agent/event
- collector/usn-cve
- source/Ubuntu
- vendor/bluez
- canonical/bluez bluez
- vendor/canonical
- canonical/canonical ubuntu linux
- version/canonical ubuntu linux/18.04
- package-manager/debian
- package-manager/ubuntu