BlueZ could be made to give a physically proximate attacker keyboard and mouse control of a computer.. ========================================================================== Ubuntu Security Notice USN-6540-1 December 07, 2023 bluez vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 23.10 - Ubuntu 23.04 - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS (Available with Ubuntu Pro) - Ubuntu 16.04 LTS (Available with Ubuntu Pro) Summary: BlueZ could be made to give a physically proximate attacker keyboard and mouse control of a computer. Software Description: - bluez: Bluetooth tools and daemons Details: It was discovered that BlueZ did not properly restrict non-bonded devices from injecting HID events into the input subsystem. This could allow a physically proximate attacker to inject keystrokes and execute arbitrary commands whilst the device is discoverable. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 23.10: bluez 5.68-0ubuntu1.1 libbluetooth3 5.68-0ubuntu1.1 Ubuntu 23.04: bluez 5.66-0ubuntu1.1 libbluetooth3 5.66-0ubuntu1.1 Ubuntu 22.04 LTS: bluez 5.64-0ubuntu1.1 libbluetooth3 5.64-0ubuntu1.1 Ubuntu 20.04 LTS: bluez 5.53-0ubuntu3.7 libbluetooth3 5.53-0ubuntu3.7 Ubuntu 18.04 LTS (Available with Ubuntu Pro): bluez 5.48-0ubuntu3.9+esm1 libbluetooth3 5.48-0ubuntu3.9+esm1 Ubuntu 16.04 LTS (Available with Ubuntu Pro): bluez 5.37-0ubuntu5.3+esm3 libbluetooth3 5.37-0ubuntu5.3+esm3 In general, a standard system update will make all the necessarychanges. References: https://ubuntu.com/security/notices/USN-6540-1 CVE-2023-45866 Package Information: https://launchpad.net/ubuntu/+source/bluez/5.68-0ubuntu1.1 https://launchpad.net/ubuntu/+source/bluez/5.66-0ubuntu1.1 https://launchpad.net/ubuntu/+source/bluez/5.64-0ubuntu1.1 https://launchpad.net/ubuntu/+source/bluez/5.53-0ubuntu3.7 . The Ubuntu Security Notice USN-6541-1 discusses a flaw in OpenSSL, posing a threat to sensitive data encryption by malicious entities.. BlueZ Exploit, Input Control Flaw, Security Update. . Severity: Critical. LinuxSecurity.com Team
It was discovered that multitouch devices were not being disabled by the "xtrlock" screen locking utility. xtrlock did not block multitouch events so an attacker could still . Package : xtrlock Version : 2.6+deb8u1 CVE ID : CVE-2016-10894 Debian Bug : #830726 It was discovered that multitouch devices were not being disabled by the "xtrlock" screen locking utility. xtrlock did not block multitouch events so an attacker could still input and thus control various programs such as Chromium, etc. via so-called "multitouch" events including pan scrolling, "pinch and zoom" or even being able to provide regular mouse clicks by depressing the touchpad once and then clicking with a secondary finger. For Debian 8 "Jessie", this issue has been fixed in xtrlock version 2.6+deb8u1. However, this fix does not the situation where an attacker plugs in a multitouch device *after* the screen has been locked. For more information on this, please see: We recommend that you upgrade your xtrlock packages pending a deeper fix. Regards, - -- ,'`. : :' : Chris Lamb `. `'`
Get the latest Linux and open source security news straight to your inbox.