Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2022-39177: BlueZ before 5.59 allows physically proximate attackers to cause a denial of service because malformed and invalid capabilities can be processed in profiles/audio/avdtp.c.

CVE-2022-39177 · published 4 years ago

Summary

BlueZ before 5.59 allows physically proximate attackers to cause a denial of service because malformed and invalid capabilities can be processed in profiles/audio/avdtp.c.

What to do

Update canonical bluez to version 5.48-0ubuntu3.9.
Update canonical bluez to version 5.53-0ubuntu3.6.
Update debian bluez to version 5.61-1.
Update bluez bluez to version 5.59 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	bluez	bluez	< 5.59 `cpe:2.3:a:bluez:bluez::::::::`
–	canonical	ubuntu_linux	18.04 20.04 `cpe:2.3:o:canonical:ubuntu_linux:18.04::::lts:::`
–	debian	debian_linux	10.0 `cpe:2.3:o:debian:debian_linux:10.0:::::::*`
Ubuntu:Pro:16.04:LTS	canonical	bluez	All versions
Ubuntu:18.04:LTS	canonical	bluez	< 5.48-0ubuntu3.9 Fix: upgrade to 5.48-0ubuntu3.9
Ubuntu:20.04:LTS	canonical	bluez	< 5.53-0ubuntu3.6 Fix: upgrade to 5.53-0ubuntu3.6
Debian:12	debian	bluez	< 5.61-1 Fix: upgrade to 5.61-1

Original advisory text

BlueZ before 5.59 allows physically proximate attackers to cause a denial of service because malformed and invalid capabilities can be processed in profiles/audio/avdtp.c.

References

https://ubuntu.com/security/CVE-2022-39177 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2022-39177 Third Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-39177 Vendor Advisory
https://security-tracker.debian.org/tracker/CVE-2022-39177 Vendor Advisory
https://bugs.launchpad.net/ubuntu/+source/bluez/+bug/1977968 URL
https://lists.debian.org/debian-lts-announce/2024/09/msg00022.html URL
https://security.netapp.com/advisory/ntap-20221020-0002/ Vendor Advisory
https://ubuntu.com/security/notices/USN-5481-1 Vendor Advisory
https://lists.debian.org/debian-lts-announce/2022/10/msg00026.html Third Party Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39177... Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

8.8 High

Exploitation

<1% chance of attack within 30 days

Timeline

Published2 Sep 2022

Updated31 Oct 2026

First seen29 Sep 2026

Sources

CVE-2022-39177 · NVD

CVE-2022-39177 · OSV

UBUNTU-CVE-2022-39177 · OSV

DEBIAN-CVE-2022-39177 · OSV

Track software like this

Free during beta