Debian Package Tracker

general

source: bluez (source, admin)
version: 5.43-2
maintainer: Debian Bluetooth Maintainers (archive) [DMD]
uploaders: Nobuhiro Iwamatsu [DMD]
arch: all
std-ver: 3.9.8
VCS: Subversion (Browse)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 4.99-2
oldstable: 5.23-2
stable: 5.43-2
testing: 5.43-2
unstable: 5.43-2

versioned links

4.99-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
5.23-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
5.43-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

bluetooth
bluez
bluez-cups
bluez-dbg
bluez-hcidump
bluez-obexd
bluez-test-scripts
bluez-test-tools
libbluetooth-dev
libbluetooth3
libbluetooth3-dbg

action needed

A new upstream version is available: 5.45

high

A new upstream version 5.45 is available, you should consider packaging it.

Created: 2017-03-01 Last update: 2017-06-27 01:14

lintian reports 33 warnings

high

Lintian reports 33 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2015-03-03 Last update: 2017-06-23 07:13

10 security issues in sid

high

There are 10 open security issues in sid.

10 important issues:

CVE-2016-9804: In BlueZ 5.42, a buffer overflow was observed in "commands_dump" function in "tools/parser/csr.c" source file. The issue exists because "commands" array is overflowed by supplied parameter due to lack of boundary checks on size of the buffer from frame "frm->ptr" parameter. This issue can be triggered by processing a corrupted dump file and will result in hcidump crash.
CVE-2016-9801: In BlueZ 5.42, a buffer overflow was observed in "set_ext_ctrl" function in "tools/parser/l2cap.c" source file when processing corrupted dump file.
CVE-2016-9800: In BlueZ 5.42, a buffer overflow was observed in "pin_code_reply_dump" function in "tools/parser/hci.c" source file. The issue exists because "pin" array is overflowed by supplied parameter due to lack of boundary checks on size of the buffer from frame "pin_code_reply_cp *cp" parameter.
CVE-2016-9803: In BlueZ 5.42, an out-of-bounds read was observed in "le_meta_ev_dump" function in "tools/parser/hci.c" source file. This issue exists because 'subevent' (which is used to read correct element from 'ev_le_meta_str' array) is overflowed.
CVE-2016-9802: In BlueZ 5.42, a buffer over-read was identified in "l2cap_packet" function in "monitor/packet.c" source file. This issue can be triggered by processing a corrupted dump file and will result in btmon crash.
CVE-2016-9918: In BlueZ 5.42, an out-of-bounds read was identified in "packet_hexdump" function in "monitor/packet.c" source file. This issue can be triggered by processing a corrupted dump file and will result in btmon crash.
CVE-2016-9799: In BlueZ 5.42, a buffer overflow was observed in "pklg_read_hci" function in "btsnoop.c" source file. This issue can be triggered by processing a corrupted dump file and will result in btmon crash.
CVE-2016-9798: In BlueZ 5.42, a use-after-free was identified in "conf_opt" function in "tools/parser/l2cap.c" source file. This issue can be triggered by processing a corrupted dump file and will result in hcidump crash.
CVE-2016-9917: In BlueZ 5.42, a buffer overflow was observed in "read_n" function in "tools/hcidump.c" source file. This issue can be triggered by processing a corrupted dump file and will result in hcidump crash.
CVE-2016-9797: In BlueZ 5.42, a buffer over-read was observed in "l2cap_dump" function in "tools/parser/l2cap.c" source file. This issue can be triggered by processing a corrupted dump file and will result in hcidump crash.

Please fix them.

Created: 2016-12-05 Last update: 2017-06-18 08:29

10 security issues in buster

high

There are 10 open security issues in buster.

10 important issues:

CVE-2016-9804: In BlueZ 5.42, a buffer overflow was observed in "commands_dump" function in "tools/parser/csr.c" source file. The issue exists because "commands" array is overflowed by supplied parameter due to lack of boundary checks on size of the buffer from frame "frm->ptr" parameter. This issue can be triggered by processing a corrupted dump file and will result in hcidump crash.
CVE-2016-9801: In BlueZ 5.42, a buffer overflow was observed in "set_ext_ctrl" function in "tools/parser/l2cap.c" source file when processing corrupted dump file.
CVE-2016-9800: In BlueZ 5.42, a buffer overflow was observed in "pin_code_reply_dump" function in "tools/parser/hci.c" source file. The issue exists because "pin" array is overflowed by supplied parameter due to lack of boundary checks on size of the buffer from frame "pin_code_reply_cp *cp" parameter.
CVE-2016-9803: In BlueZ 5.42, an out-of-bounds read was observed in "le_meta_ev_dump" function in "tools/parser/hci.c" source file. This issue exists because 'subevent' (which is used to read correct element from 'ev_le_meta_str' array) is overflowed.
CVE-2016-9802: In BlueZ 5.42, a buffer over-read was identified in "l2cap_packet" function in "monitor/packet.c" source file. This issue can be triggered by processing a corrupted dump file and will result in btmon crash.
CVE-2016-9918: In BlueZ 5.42, an out-of-bounds read was identified in "packet_hexdump" function in "monitor/packet.c" source file. This issue can be triggered by processing a corrupted dump file and will result in btmon crash.
CVE-2016-9799: In BlueZ 5.42, a buffer overflow was observed in "pklg_read_hci" function in "btsnoop.c" source file. This issue can be triggered by processing a corrupted dump file and will result in btmon crash.
CVE-2016-9798: In BlueZ 5.42, a use-after-free was identified in "conf_opt" function in "tools/parser/l2cap.c" source file. This issue can be triggered by processing a corrupted dump file and will result in hcidump crash.
CVE-2016-9917: In BlueZ 5.42, a buffer overflow was observed in "read_n" function in "tools/hcidump.c" source file. This issue can be triggered by processing a corrupted dump file and will result in hcidump crash.
CVE-2016-9797: In BlueZ 5.42, a buffer over-read was observed in "l2cap_dump" function in "tools/parser/l2cap.c" source file. This issue can be triggered by processing a corrupted dump file and will result in hcidump crash.

Please fix them.

Created: 2017-06-18 Last update: 2017-06-18 08:29

Multiarch hinter reports 5 issue(s)

normal

There are issues with the multiarch metadata for this package.

bluetooth could be marked Multi-Arch: foreign
bluez-test-scripts could be marked Multi-Arch: foreign
bluez-dbg could be marked Multi-Arch: same
libbluetooth-dev could be marked Multi-Arch: same
libbluetooth3-dbg could be marked Multi-Arch: same

Created: 2016-09-14 Last update: 2017-06-27 01:23

1 bug tagged patch in the BTS

normal

The BTS contains patches fixing 1 bug, consider including or untagging them.

Created: 2017-01-17 Last update: 2017-06-27 00:59

11 ignored security issues in wheezy

low

There are 11 open security issues in wheezy.

11 issues skipped by the security teams:

CVE-2016-9804: In BlueZ 5.42, a buffer overflow was observed in "commands_dump" function in "tools/parser/csr.c" source file. The issue exists because "commands" array is overflowed by supplied parameter due to lack of boundary checks on size of the buffer from frame "frm->ptr" parameter. This issue can be triggered by processing a corrupted dump file and will result in hcidump crash.
CVE-2016-9801: In BlueZ 5.42, a buffer overflow was observed in "set_ext_ctrl" function in "tools/parser/l2cap.c" source file when processing corrupted dump file.
CVE-2016-7837: Buffer overflow in BlueZ 5.41 and earlier allows an attacker to execute arbitrary code via the parse_line function used in some userland utilities.
CVE-2016-9803: In BlueZ 5.42, an out-of-bounds read was observed in "le_meta_ev_dump" function in "tools/parser/hci.c" source file. This issue exists because 'subevent' (which is used to read correct element from 'ev_le_meta_str' array) is overflowed.
CVE-2016-9802: In BlueZ 5.42, a buffer over-read was identified in "l2cap_packet" function in "monitor/packet.c" source file. This issue can be triggered by processing a corrupted dump file and will result in btmon crash.
CVE-2016-9918: In BlueZ 5.42, an out-of-bounds read was identified in "packet_hexdump" function in "monitor/packet.c" source file. This issue can be triggered by processing a corrupted dump file and will result in btmon crash.
CVE-2016-9799: In BlueZ 5.42, a buffer overflow was observed in "pklg_read_hci" function in "btsnoop.c" source file. This issue can be triggered by processing a corrupted dump file and will result in btmon crash.
CVE-2016-9798: In BlueZ 5.42, a use-after-free was identified in "conf_opt" function in "tools/parser/l2cap.c" source file. This issue can be triggered by processing a corrupted dump file and will result in hcidump crash.
CVE-2016-9917: In BlueZ 5.42, a buffer overflow was observed in "read_n" function in "tools/hcidump.c" source file. This issue can be triggered by processing a corrupted dump file and will result in hcidump crash.
CVE-2016-9797: In BlueZ 5.42, a buffer over-read was observed in "l2cap_dump" function in "tools/parser/l2cap.c" source file. This issue can be triggered by processing a corrupted dump file and will result in hcidump crash.
CVE-2016-9800: In BlueZ 5.42, a buffer overflow was observed in "pin_code_reply_dump" function in "tools/parser/hci.c" source file. The issue exists because "pin" array is overflowed by supplied parameter due to lack of boundary checks on size of the buffer from frame "pin_code_reply_cp *cp" parameter.

Please fix them.

Created: 2016-12-05 Last update: 2017-06-18 08:29

11 ignored security issues in jessie

low

There are 11 open security issues in jessie.

11 issues skipped by the security teams:

CVE-2016-9804: In BlueZ 5.42, a buffer overflow was observed in "commands_dump" function in "tools/parser/csr.c" source file. The issue exists because "commands" array is overflowed by supplied parameter due to lack of boundary checks on size of the buffer from frame "frm->ptr" parameter. This issue can be triggered by processing a corrupted dump file and will result in hcidump crash.
CVE-2016-9801: In BlueZ 5.42, a buffer overflow was observed in "set_ext_ctrl" function in "tools/parser/l2cap.c" source file when processing corrupted dump file.
CVE-2016-7837: Buffer overflow in BlueZ 5.41 and earlier allows an attacker to execute arbitrary code via the parse_line function used in some userland utilities.
CVE-2016-9803: In BlueZ 5.42, an out-of-bounds read was observed in "le_meta_ev_dump" function in "tools/parser/hci.c" source file. This issue exists because 'subevent' (which is used to read correct element from 'ev_le_meta_str' array) is overflowed.
CVE-2016-9802: In BlueZ 5.42, a buffer over-read was identified in "l2cap_packet" function in "monitor/packet.c" source file. This issue can be triggered by processing a corrupted dump file and will result in btmon crash.
CVE-2016-9918: In BlueZ 5.42, an out-of-bounds read was identified in "packet_hexdump" function in "monitor/packet.c" source file. This issue can be triggered by processing a corrupted dump file and will result in btmon crash.
CVE-2016-9799: In BlueZ 5.42, a buffer overflow was observed in "pklg_read_hci" function in "btsnoop.c" source file. This issue can be triggered by processing a corrupted dump file and will result in btmon crash.
CVE-2016-9798: In BlueZ 5.42, a use-after-free was identified in "conf_opt" function in "tools/parser/l2cap.c" source file. This issue can be triggered by processing a corrupted dump file and will result in hcidump crash.
CVE-2016-9917: In BlueZ 5.42, a buffer overflow was observed in "read_n" function in "tools/hcidump.c" source file. This issue can be triggered by processing a corrupted dump file and will result in hcidump crash.
CVE-2016-9797: In BlueZ 5.42, a buffer over-read was observed in "l2cap_dump" function in "tools/parser/l2cap.c" source file. This issue can be triggered by processing a corrupted dump file and will result in hcidump crash.
CVE-2016-9800: In BlueZ 5.42, a buffer overflow was observed in "pin_code_reply_dump" function in "tools/parser/hci.c" source file. The issue exists because "pin" array is overflowed by supplied parameter due to lack of boundary checks on size of the buffer from frame "pin_code_reply_cp *cp" parameter.

Please fix them.

Created: 2016-12-05 Last update: 2017-06-18 08:29

10 ignored security issues in stretch

low

There are 10 open security issues in stretch.

10 issues skipped by the security teams:

CVE-2016-9804: In BlueZ 5.42, a buffer overflow was observed in "commands_dump" function in "tools/parser/csr.c" source file. The issue exists because "commands" array is overflowed by supplied parameter due to lack of boundary checks on size of the buffer from frame "frm->ptr" parameter. This issue can be triggered by processing a corrupted dump file and will result in hcidump crash.
CVE-2016-9801: In BlueZ 5.42, a buffer overflow was observed in "set_ext_ctrl" function in "tools/parser/l2cap.c" source file when processing corrupted dump file.
CVE-2016-9800: In BlueZ 5.42, a buffer overflow was observed in "pin_code_reply_dump" function in "tools/parser/hci.c" source file. The issue exists because "pin" array is overflowed by supplied parameter due to lack of boundary checks on size of the buffer from frame "pin_code_reply_cp *cp" parameter.
CVE-2016-9803: In BlueZ 5.42, an out-of-bounds read was observed in "le_meta_ev_dump" function in "tools/parser/hci.c" source file. This issue exists because 'subevent' (which is used to read correct element from 'ev_le_meta_str' array) is overflowed.
CVE-2016-9802: In BlueZ 5.42, a buffer over-read was identified in "l2cap_packet" function in "monitor/packet.c" source file. This issue can be triggered by processing a corrupted dump file and will result in btmon crash.
CVE-2016-9918: In BlueZ 5.42, an out-of-bounds read was identified in "packet_hexdump" function in "monitor/packet.c" source file. This issue can be triggered by processing a corrupted dump file and will result in btmon crash.
CVE-2016-9799: In BlueZ 5.42, a buffer overflow was observed in "pklg_read_hci" function in "btsnoop.c" source file. This issue can be triggered by processing a corrupted dump file and will result in btmon crash.
CVE-2016-9798: In BlueZ 5.42, a use-after-free was identified in "conf_opt" function in "tools/parser/l2cap.c" source file. This issue can be triggered by processing a corrupted dump file and will result in hcidump crash.
CVE-2016-9917: In BlueZ 5.42, a buffer overflow was observed in "read_n" function in "tools/hcidump.c" source file. This issue can be triggered by processing a corrupted dump file and will result in hcidump crash.
CVE-2016-9797: In BlueZ 5.42, a buffer over-read was observed in "l2cap_dump" function in "tools/parser/l2cap.c" source file. This issue can be triggered by processing a corrupted dump file and will result in hcidump crash.

Please fix them.

Created: 2016-12-05 Last update: 2017-06-18 08:29

testing migrations

This package will soon be part of the auto-icu transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.

news

[rss feed]

[2017-03-25] bluez 5.43-2 MIGRATED to testing (Debian testing watch)
[2017-03-19] Accepted bluez 5.43-2 (source all amd64) into unstable (Nobuhiro Iwamatsu)
[2016-11-06] bluez 5.43-1 MIGRATED to testing (Debian testing watch)
[2016-10-31] Accepted bluez 5.43-1 (source all amd64) into unstable (Nobuhiro Iwamatsu)
[2016-10-30] bluez 5.41-1 MIGRATED to testing (Debian testing watch)
[2016-10-25] Accepted bluez 5.41-1 (source all amd64) into unstable (Nobuhiro Iwamatsu)
[2016-07-26] Accepted bluez 5.40-1~exp0 (source all amd64) into experimental, experimental (Nobuhiro Iwamatsu)
[2015-11-12] bluez 5.36-1 MIGRATED to testing (Britney)
[2015-11-07] Accepted bluez 5.36-1 (source all amd64) into unstable (Nobuhiro Iwamatsu)
[2015-08-24] bluez 5.33-1 MIGRATED to testing (Britney)
[2015-08-18] Accepted bluez 5.33-1 (source all amd64) into unstable (Nobuhiro Iwamatsu)
[2014-12-10] bluez 5.23-2 MIGRATED to testing (Britney)
[2014-12-05] Accepted bluez 5.23-2 (source amd64 all) into unstable (Nobuhiro Iwamatsu)
[2014-09-18] bluez 5.23-1 MIGRATED to testing (Britney)
[2014-09-16] Accepted bluez 5.23-1 (source amd64 all) into unstable (Nobuhiro Iwamatsu)
[2014-08-26] bluez 5.21-3 MIGRATED to testing (Britney)
[2014-08-20] Accepted bluez 5.21-3 (source amd64 all) into unstable (Nobuhiro Iwamatsu)
[2014-08-03] bluez 5.21-2 MIGRATED to testing (Britney)
[2014-07-28] Accepted bluez 5.21-2 (source amd64 all) (Nobuhiro Iwamatsu)
[2014-07-13] Accepted bluez 5.21-1 (source amd64 all) (Nobuhiro Iwamatsu)
[2014-07-08] Accepted bluez 5.21-1~exp0 (source amd64 all) (Nobuhiro Iwamatsu)
[2014-07-07] Accepted bluez 5.20-1~exp0 (source amd64 all) (Nobuhiro Iwamatsu)
[2014-06-24] Accepted bluez 5.19-1~exp0 (source amd64 all) (Nobuhiro Iwamatsu)
[2014-04-15] Accepted bluez 5.17-1~exp0 (source amd64 all) (Nobuhiro Iwamatsu)
[2014-03-11] bluez 4.101-4.1 MIGRATED to testing (Debian testing watch)
[2014-03-06] Accepted bluez 4.101-4.1 (source all amd64) (Michael Biebl)
[2013-12-25] bluez 4.101-4 MIGRATED to testing (Debian testing watch)
[2013-12-14] Accepted bluez 4.101-4 (source all amd64) (Nobuhiro Iwamatsu)
[2013-10-06] bluez 4.101-3 MIGRATED to testing (Debian testing watch)
[2013-09-26] Accepted bluez 4.101-3 (source all amd64) (Nobuhiro Iwamatsu)

bugs [bug history graph]

all: 99 106
RC: 0
I&N: 89 95
M&W: 10 11
F&P: 0

links

homepage
lintian (0, 33)
buildd: logs, clang, reproducibility
popcon
browse source code
edit tags
security tracker
screenshots

ubuntu

[Information about Ubuntu for Debian Developers]

version: 5.45-0ubuntu2
333 bugs (4 patches)
patches for 5.45-0ubuntu2