CVE-2016-9800Improper Restriction of Operations within the Bounds of a Memory Buffer in Bluez

Severity
5.3MEDIUMNVD
OSV6.8
EPSS
0.4%
top 40.15%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedDec 3
Latest updateMay 17

Description

In BlueZ 5.42, a buffer overflow was observed in "pin_code_reply_dump" function in "tools/parser/hci.c" source file. The issue exists because "pin" array is overflowed by supplied parameter due to lack of boundary checks on size of the buffer from frame "pin_code_reply_cp *cp" parameter.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LExploitability: 3.9 | Impact: 1.4

Affected Packages3 packages

NVDbluez/bluez5.42
debiandebian/bluez
Ubuntuapache/subversion< 1.8.8-1ubuntu3.3+1

🔴Vulnerability Details

4
GHSA
GHSA-pcrc-6m42-jvr8: In BlueZ 52022-05-17
OSV
subversion vulnerabilities2017-08-11
OSV
CVE-2016-9800: In BlueZ 52016-12-03
CVEList
CVE-2016-9800: In BlueZ 52016-12-03

📋Vendor Advisories

2
Red Hat
bluez: buffer overflow in pin_code_reply_dump()2016-12-03
Debian
CVE-2016-9800: bluez - In BlueZ 5.42, a buffer overflow was observed in "pin_code_reply_dump" function ...2016

💬Community

2
Bugzilla
CVE-2016-9797, CVE-2016-9798, CVE-2016-9800, CVE-2016-9801, CVE-2016-9803 bluez-hcidump: various flaws [fedora-all]2016-12-05
Bugzilla
CVE-2016-9800 bluez: buffer overflow in pin_code_reply_dump()2016-12-05