CVE-2016-9804 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Bluez

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory BufferCWE-120 — Classic Buffer Overflow8 documents6 sources
Severity
5.3MEDIUMNVD
EPSS
0.4%
top 41.80%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
BluezDebian Bluez
Timeline
PublishedDec 3
Latest updateMay 17

Description

In BlueZ 5.42, a buffer overflow was observed in "commands_dump" function in "tools/parser/csr.c" source file. The issue exists because "commands" array is overflowed by supplied parameter due to lack of boundary checks on size of the buffer from frame "frm->ptr" parameter. This issue can be triggered by processing a corrupted dump file and will result in hcidump crash.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LExploitability: 3.9 | Impact: 1.4

Affected Packages2 packages

▶NVDbluez/bluez5.42
▶debiandebian/bluez

🔴Vulnerability Details

2
GHSA
GHSA-7f98-f74w-8q8j: In BlueZ 5↗2022-05-17
▶
OSV
CVE-2016-9804: In BlueZ 5↗2016-12-03
▶

📋Vendor Advisories

2
Red Hat
bluez: buffer overflow in commands_dump()↗2016-12-03
▶
Debian
CVE-2016-9804: bluez - In BlueZ 5.42, a buffer overflow was observed in "commands_dump" function in "to...↗2016
▶

💬Community

3
Bugzilla
CVE-2016-9804 bluez: buffer overflow in commands_dump()↗2016-12-05
▶
Bugzilla
CVE-2016-9799, CVE-2016-9802, CVE-2016-9804 bluez: various flaws [fedora-all]↗2016-12-05
▶
Bugzilla
CVE-2014-9804 ImageMagick: infinite loop DoS in vision.c↗2016-06-07
▶