CVE-2022-39176: High severity BlueZ BlueZ vulnerability
BlueZ before 5.59 allows physically proximate attackers to obtain sensitive information because profiles/audio/avrcp.c does not validate paramslen.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/bluezto a version that resolves this vulnerability.Fixed in 5.66-1+deb12u2Fixed in 5.66-1+deb12u1Fixed in 5.82-1.1Fixed in 5.87-5 - Upgrade
Upgrade
debian/bluezto a version that resolves this vulnerability.Fixed in 5.61-1
Event History
Frequently Asked Questions
What is CVE-2022-39176?
CVE-2022-39176 is a vulnerability in BlueZ before version 5.59 that allows physically proximate attackers to obtain sensitive information.
How does CVE-2022-39176 affect BlueZ?
CVE-2022-39176 affects BlueZ versions before 5.59.
What is the severity of CVE-2022-39176?
The severity of CVE-2022-39176 is high with a CVSS score of 8.8.
How can an attacker exploit CVE-2022-39176?
An attacker can exploit CVE-2022-39176 by being physically proximate to the target device and obtaining sensitive information.
How to fix CVE-2022-39176?
To fix CVE-2022-39176, update BlueZ to version 5.59 or later.