Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges

Alerts This Week
Warning Icon 1 488
Alerts This Week
Warning Icon 1 488

Ubuntu 19.10, 18.04 LTS, 16.04 LTS: BlueZ Security Advisory Details

ubuntu
Calendar Grey March 30, 2020
Scroller Ubuntu
A range of problems in NetworkManager were addressed in multiple Ubuntu versions, providing enhanced protection for its users.
Several security issues were fixed in BlueZ.

Summary

Several security issues were fixed in BlueZ.

Software Description:

- bluez: Bluetooth tools and daemons

Details:

It was discovered that BlueZ incorrectly handled bonding HID and HOGP

devices. A local attacker could possibly use this issue to impersonate

non-bonded devices. (CVE-2020-0556)

It was discovered that BlueZ incorrectly handled certain commands. A local

attacker could use this issue to cause BlueZ to crash, resulting in a

denial of service, or possibly execute arbitrary code. This issue only

affected Ubuntu 16.04 LTS. (CVE-2016-7837)

Topics%20covered

Topics Covered

security advisory denial of service ubuntu local attacker bluez

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 19.10:
  bluez                           5.50-0ubuntu5.1
  libbluetooth3                   5.50-0ubuntu5.1

Ubuntu 18.04 LTS:
  bluez                           5.48-0ubuntu3.4
  libbluetooth3                   5.48-0ubuntu3.4

Ubuntu 16.04 LTS:
  bluez                           5.37-0ubuntu5.3
  libbluetooth3                   5.37-0ubuntu5.3

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-4311-1

CVE-2016-7837, CVE-2020-0556

Severity
important
Lowest
Low
Medium
High
Critical

March 30, 2020

Topics%20covered

Topics Covered

security advisory denial of service ubuntu local attacker bluez

Package Information

https://launchpad.net/ubuntu/+source/bluez/5.50-0ubuntu5.1
https://launchpad.net/ubuntu/+source/bluez/5.48-0ubuntu3.4
https://launchpad.net/ubuntu/+source/bluez/5.37-0ubuntu5.3

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.