All versions of the SDP server in BlueZ 5.46 and earlier are vulnerable to an information disclosure vulnerability which allows remote attackers to obtain sensitive information from the bluetoothd process memory. This vulnerability lies in the processing of SDP search attribute requests.
CVSS Details
- CVSS 3.0 Base Score: 6.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade bluez | Sep 21, 2017 | Sep 12, 2017 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Sep 12, 2017 |
| Centos_linux | — | Upgrade bluez-gstreamerUpgrade bluez-compatUpgrade bluez-libs-develUpgrade bluez-alsaUpgrade bluez-debuginfoUpgrade bluezUpgrade bluez-libsUpgrade bluez-cupsUpgrade bluez-hid2hci | Sep 13, 2017 | Sep 12, 2017 |
| Debian | — | Upgrade bluez | Sep 15, 2017 | Sep 12, 2017 |
| Oracle_linux | — | Upgrade bluez-compatUpgrade bluezUpgrade bluez-libsUpgrade bluez-alsaUpgrade bluez-hid2hciUpgrade bluez-cupsUpgrade bluez-libs-develUpgrade bluez-gstreamer | Sep 13, 2017 | Sep 12, 2017 |
| Redhat_linux | — | Upgrade bluez-cupsUpgrade bluez-compatUpgrade bluez-debuginfoUpgrade bluez-libs-develUpgrade bluez-libsUpgrade bluez-alsaUpgrade bluez-hid2hciNo solution existsUpgrade bluezUpgrade bluez-gstreamer | Oct 4, 2017 | Sep 12, 2017 |
| Suse | — | Upgrade bluez-cupsUpgrade libbluetooth3Upgrade bluezUpgrade bluez-devel | Oct 20, 2017 | Sep 12, 2017 |
| Ubuntu | — | Upgrade bluezUpgrade libbluetooth3 | Sep 13, 2017 | Sep 12, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub