USN-4989-2: BlueZ vulnerabilities

Published Jun 16, 2021

Updated

USN-4989-1 fixed several vulnerabilities in BlueZ. This update provides the corresponding update for Ubuntu 16.04 ESM. Original advisory details: It was discovered that BlueZ incorrectly checked certain permissions when pairing. A local attacker could possibly use this issue to impersonate devices. (CVE-2020-26558) Jay LV discovered that BlueZ incorrectly handled redundant disconnect MGMT events. A local attacker could use this issue to cause BlueZ to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-27153)

Affected Software

1 affected component

BlueZ BlueZ

Event History

May 10, 2025

Advisory Published

via Ubuntu·03:47 AM

Data Sourced

via Ubuntu·03:47 AM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

What is the vulnerability ID for this update?

The vulnerability ID for this update is USN-4989-2.

What software is affected by this vulnerability?

BlueZ and libbluetooth3 versions 5.37-0ubuntu5.3+esm1 on Ubuntu 16.04 are affected.

How can an attacker exploit this vulnerability?

A local attacker could exploit this vulnerability by impersonating a device during the pairing process.

Are there any known mitigations for this vulnerability?

Updating to version 5.37-0ubuntu5.3+esm1 of BlueZ and libbluetooth3 will mitigate this vulnerability.

Where can I find more information about this vulnerability?

More information about this vulnerability can be found at the following references: [CVE-2020-26558](https://ubuntu.com/security/CVE-2020-26558) and [CVE-2020-27153](https://ubuntu.com/security/CVE-2020-27153).