- Vulnerability/
- USN-4311-1
USN-4311-1: BlueZ vulnerabilities
First published: Mon Mar 30 2020(Updated: )
It was discovered that BlueZ incorrectly handled bonding HID and HOGP devices. A local attacker could possibly use this issue to impersonate non-bonded devices. (CVE-2020-0556) It was discovered that BlueZ incorrectly handled certain commands. A local attacker could use this issue to cause BlueZ to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-7837)
| Affected Software | Affected Version | How to fix |
|---|---|---|
| All of | ||
| ubuntu/bluez | <5.50-0ubuntu5.1 | 5.50-0ubuntu5.1 |
| =19.10 | ||
| All of | ||
| ubuntu/libbluetooth3 | <5.50-0ubuntu5.1 | 5.50-0ubuntu5.1 |
| =19.10 | ||
| All of | ||
| ubuntu/bluez | <5.48-0ubuntu3.4 | 5.48-0ubuntu3.4 |
| =18.04 | ||
| All of | ||
| ubuntu/libbluetooth3 | <5.48-0ubuntu3.4 | 5.48-0ubuntu3.4 |
| =18.04 | ||
| All of | ||
| ubuntu/bluez | <5.37-0ubuntu5.3 | 5.37-0ubuntu5.3 |
| =16.04 | ||
| All of | ||
| ubuntu/libbluetooth3 | <5.37-0ubuntu5.3 | 5.37-0ubuntu5.3 |
| =16.04 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://ubuntu.com/security/CVE-2016-7837
- https://ubuntu.com/security/CVE-2020-0556
- https://launchpad.net/ubuntu/+source/bluez/5.50-0ubuntu5.1
- https://launchpad.net/ubuntu/+source/bluez/5.48-0ubuntu3.4
- https://launchpad.net/ubuntu/+source/bluez/5.37-0ubuntu5.3
- https://ubuntu.com/security/notices/USN-4311-1 (Advisory)
Frequently Asked Questions
What is the vulnerability ID for this advisory?
The vulnerability ID for this advisory is CVE-2020-0556.
What is the severity of CVE-2020-0556?
The severity of CVE-2020-0556 is not mentioned in the advisory. Please refer to the CVE page for more information.
How does BlueZ handle bonding HID and HOGP devices?
BlueZ incorrectly handles bonding HID and HOGP devices.
What is the potential impact of the vulnerability?
The vulnerability could allow a local attacker to impersonate non-bonded devices.
How do I fix the BlueZ vulnerabilities?
To fix the BlueZ vulnerabilities, update the bluez and libbluetooth3 packages to the specified versions mentioned in the advisory.
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/title
- agent/type
- collector/usn
- source/Ubuntu
- agent/software-canonical-lookup
- package-manager/ubuntu
- vendor/ubuntu
- canonical/ubuntu ubuntu
- version/ubuntu ubuntu/19.10
- version/ubuntu ubuntu/18.04
- version/ubuntu ubuntu/16.04