CVE-2016-9798 — Use After Free in Bluez

CWE-416 — Use After Free7 documents6 sources
Severity
5.3MEDIUMNVD
EPSS
0.5%
top 34.52%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
BluezDebian Bluez
Timeline
PublishedDec 3
Latest updateMay 14

Description

In BlueZ 5.42, a use-after-free was identified in "conf_opt" function in "tools/parser/l2cap.c" source file. This issue can be triggered by processing a corrupted dump file and will result in hcidump crash.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LExploitability: 3.9 | Impact: 1.4

Affected Packages2 packages

▶NVDbluez/bluez5.42
▶debiandebian/bluez

🔴Vulnerability Details

2
GHSA
GHSA-777g-v2xh-6rvf: In BlueZ 5↗2022-05-14
▶
OSV
CVE-2016-9798: In BlueZ 5↗2016-12-03
▶

📋Vendor Advisories

2
Red Hat
bluez: use-after-free in conf_opt()↗2016-12-03
▶
Debian
CVE-2016-9798: bluez - In BlueZ 5.42, a use-after-free was identified in "conf_opt" function in "tools/...↗2016
▶

💬Community

2
Bugzilla
CVE-2016-9798 bluez: use-after-free in conf_opt()↗2016-12-05
▶
Bugzilla
CVE-2016-9797, CVE-2016-9798, CVE-2016-9800, CVE-2016-9801, CVE-2016-9803 bluez-hcidump: various flaws [fedora-all]↗2016-12-05
▶