In BlueZ before 5.55, a double free was found in the gatttool disconnect_cb() routine from shared/att.c. A remote attacker could potentially cause a denial of service or code execution, during service discovery, due to a redundant disconnect MGMT event.
{ "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro", "ubuntu_priority": "low", "binaries": [ { "libbluetooth3": "5.37-0ubuntu5.3+esm1", "bluez-dbgsym": "5.37-0ubuntu5.3+esm1", "bluez-hcidump": "5.37-0ubuntu5.3+esm1", "bluez-hcidump-dbgsym": "5.37-0ubuntu5.3+esm1", "bluez-obexd-dbgsym": "5.37-0ubuntu5.3+esm1", "bluez-cups-dbgsym": "5.37-0ubuntu5.3+esm1", "bluez-dbg": "5.37-0ubuntu5.3+esm1", "libbluetooth-dev": "5.37-0ubuntu5.3+esm1", "bluetooth": "5.37-0ubuntu5.3+esm1", "libbluetooth3-dbgsym": "5.37-0ubuntu5.3+esm1", "bluez-tests-dbgsym": "5.37-0ubuntu5.3+esm1", "bluez-cups": "5.37-0ubuntu5.3+esm1", "bluez-tests": "5.37-0ubuntu5.3+esm1", "libbluetooth-dev-dbgsym": "5.37-0ubuntu5.3+esm1", "libbluetooth3-dbg": "5.37-0ubuntu5.3+esm1", "bluez": "5.37-0ubuntu5.3+esm1", "bluez-obexd": "5.37-0ubuntu5.3+esm1" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "low", "binaries": [ { "libbluetooth3": "5.48-0ubuntu3.5", "bluetooth": "5.48-0ubuntu3.5", "bluez-hcidump": "5.48-0ubuntu3.5", "bluez-cups": "5.48-0ubuntu3.5", "bluez-tests": "5.48-0ubuntu3.5", "libbluetooth3-dbg": "5.48-0ubuntu3.5", "bluez-dbg": "5.48-0ubuntu3.5", "libbluetooth-dev": "5.48-0ubuntu3.5", "bluez": "5.48-0ubuntu3.5", "bluez-obexd": "5.48-0ubuntu3.5" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "low", "binaries": [ { "libbluetooth3": "5.53-0ubuntu3.2", "bluetooth": "5.53-0ubuntu3.2", "bluez-hcidump": "5.53-0ubuntu3.2", "bluez-cups": "5.53-0ubuntu3.2", "bluez-tests": "5.53-0ubuntu3.2", "libbluetooth3-dbg": "5.53-0ubuntu3.2", "bluez-dbg": "5.53-0ubuntu3.2", "libbluetooth-dev": "5.53-0ubuntu3.2", "bluez": "5.53-0ubuntu3.2", "bluez-obexd": "5.53-0ubuntu3.2" } ] }