The clifeatread_cb() function in src/gatt-database.c does not perform bounds checks on the 'offset' variable before using it as an index into an array for reading.
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "libbluetooth3": "5.53-0ubuntu3.2", "bluetooth": "5.53-0ubuntu3.2", "bluez-hcidump": "5.53-0ubuntu3.2", "bluez-cups": "5.53-0ubuntu3.2", "bluez-tests": "5.53-0ubuntu3.2", "libbluetooth3-dbg": "5.53-0ubuntu3.2", "bluez-dbg": "5.53-0ubuntu3.2", "libbluetooth-dev": "5.53-0ubuntu3.2", "bluez": "5.53-0ubuntu3.2", "bluez-obexd": "5.53-0ubuntu3.2" } ] }