[Git][security-tracker-team/security-tracker][master] new bluez issues

[Moritz Muehlenhoff (@jmm)]

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
1e92ba5e by Moritz Muehlenhoff at 2024-05-08T09:40:37+02:00
new bluez issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -1463,9 +1463,13 @@ CVE-2023-50232 (Inductive Automation Ignition getParams Argument Injection Remot
 CVE-2023-50231 (NETGEAR ProSAFE Network Management System saveNodeLabel Cross-Site Scr ...)
 	NOT-FOR-US: Netgear
 CVE-2023-50230 (BlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code ...)
-	TODO: check
-CVE-2023-50229 (BlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code ...)
-	TODO: check
+	- bluez 5.70-1.1
+	NOTE: https://www.zerodayinitiative.com/advisories/ZDI-23-1812/
+	NOTE: https://github.com/bluez/bluez/commit/5ab5352531a9cc7058cce569607f3a6831464443
+CVE-2023-50229 (BlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code ...) (5.70)
+	- bluez 5.70-1.1
+	NOTE: https://www.zerodayinitiative.com/advisories/ZDI-23-1811/
+	NOTE: https://github.com/bluez/bluez/commit/5ab5352531a9cc7058cce569607f3a6831464443 (5.70)
 CVE-2023-50228 (Parallels Desktop Updater Improper Verification of Cryptographic Signa ...)
 	NOT-FOR-US: Parallels Desktop
 CVE-2023-50227 (Parallels Desktop virtio-gpu Out-Of-Bounds Write Remote Code Execution ...)
@@ -1589,7 +1593,8 @@ CVE-2023-44433 (Kofax Power PDF AcroForm Annotation Out-Of-Bounds Read Informati
 CVE-2023-44432 (Kofax Power PDF PDF File Parsing Out-Of-Bounds Write Remote Code Execu ...)
 	NOT-FOR-US: Kofax Power PDF
 CVE-2023-44431 (BlueZ Audio Profile AVRCP Stack-based Buffer Overflow Remote Code Exec ...)
-	TODO: check
+	- bluez <unfixed>
+	NOTE: https://www.zerodayinitiative.com/advisories/ZDI-23-1900/
 CVE-2023-44430 (Bentley View SKP File Parsing Use-After-Free Remote Code Execution Vul ...)
 	NOT-FOR-US: Bentley
 CVE-2023-44428 (MuseScore CAP File Parsing Heap-based Buffer Overflow Remote Code Exec ...)
@@ -82461,7 +82466,9 @@ CVE-2023-27351 (This vulnerability allows remote attackers to bypass authenticat
 CVE-2023-27350 (This vulnerability allows remote attackers to bypass authentication on ...)
 	NOT-FOR-US: PaperCut
 CVE-2023-27349 (BlueZ Audio Profile AVRCP Improper Validation of Array Index Remote Co ...)
-	TODO: check
+	- bluez 5.68-1
+	NOTE: https://www.zerodayinitiative.com/advisories/ZDI-23-386/
+	NOTE: https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/?id=f54299a850676d92c3dafd83e9174fcfe420ccc9 (5.67)
 CVE-2023-27348 (PDF-XChange Editor TIF File Parsing Use-After-Free Remote Code Executi ...)
 	NOT-FOR-US: PDF-XChange Editor
 CVE-2023-27347 (G DATA Total Security Link Following Local Privilege Escalation Vulner ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/1e92ba5eed00354f48e1abc117400b06669313d4

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/1e92ba5eed00354f48e1abc117400b06669313d4
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20240508/1afc36bb/attachment-0001.htm>