MGASA-2021-0532

See a problem?
Please try reporting it to the source first.
Source
https://advisories.mageia.org/MGASA-2021-0532.html
Import Source
https://advisories.mageia.org/MGASA-2021-0532.json
JSON Data
https://api.test.osv.dev/v1/vulns/MGASA-2021-0532
Related
Published
2021-12-02T16:49:28Z
Modified
2021-12-02T16:15:42Z
Summary
Updated bluez packages fix security vulnerability
Details

BlueZ is a Bluetooth protocol stack for Linux. In affected versions a vulnerability exists in sdpcstatealloc_buf which allocates memory which will always be hung in the singly linked list of cstates and will not be freed. This will cause a memory leak over time. The data can be a very large object, which can be caused by an attacker continuously sending sdp packets and this may cause the service of the target device to crash. (CVE-2021-41229)

An issue was discovered in gatt-database.c in BlueZ 5.61. A use-after-free can occur when a client disconnects during D-Bus processing of a WriteValue call. (CVE-2021-43400)

References
Credits

Affected packages

Mageia:8 / bluez

Package

Name
bluez
Purl
pkg:rpm/mageia/bluez?distro=mageia-8

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.55-3.3.mga8

Ecosystem specific 

{
    "section": "core"
}