BlueZ before 5.59 allows physically proximate attackers to obtain sensitive information because profiles/audio/avrcp.c does not validate params_len.

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1777541445 advisory.

  - A heap overflow vulnerability was found in bluez in versions prior to 5.63. An attacker with local network     access could pass specially crafted files causing an application to halt or crash, leading to a denial of     service. (CVE-2022-0204)

  - BlueZ before 5.59 allows physically proximate attackers to obtain sensitive information because     profiles/audio/avrcp.c does not validate params_len. (CVE-2022-39176)

  - BlueZ before 5.59 allows physically proximate attackers to cause a denial of service because malformed and     invalid capabilities can be processed in profiles/audio/avdtp.c. (CVE-2022-39177)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0008 advisory.

    This advisory aggregates security fixes for the bluez SRPM in CIQ LTS 8.6. It addresses 3 CVEs:
    CVE-2021-41229, CVE-2022-39176, CVE-2022-39177.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-054066 advisory.

    BlueZ before 5.59 allows physically proximate attackers to obtain sensitive information because     profiles/audio/avrcp.c does not validate params_len.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-680605 advisory.

    BlueZ before 5.59 allows physically proximate attackers to obtain sensitive information because     profiles/audio/avrcp.c does not validate params_len.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - BlueZ before 5.59 allows physically proximate attackers to obtain sensitive information because     profiles/audio/avrcp.c does not validate params_len. (CVE-2022-39176)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3879 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3879-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                          Adrian Bunk     September 07, 2024                            https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : bluez     Version        : 5.55-3.1+deb11u2     CVE ID         : CVE-2021-3658 CVE-2021-41229 CVE-2021-43400 CVE-2022-0204                      CVE-2022-39176 CVE-2022-39177 CVE-2023-27349 CVE-2023-50229                      CVE-2023-50230     Debian Bug     : 991596 998626 1000262 1003712

    Multiple vulnerabilities have been fixed in bluez library, tools and     daemons for using Bluetooth devices.

    CVE-2021-3658

        adapter: Fix storing discoverable setting

    CVE-2021-41229

        Memory leak in the SDP protocol

    CVE-2021-43400

        Use-after-free on client disconnect

    CVE-2022-0204

        GATT heap overflow

    CVE-2022-39176

        Proximate attackers could obtain sensitive information

    CVE-2022-39177

        Proximate attackers could cause denial of service

    CVE-2023-27349

        AVRCP crash while handling unsupported events

    CVE-2023-50229

        Phone Book Access profile Heap-based Buffer Overflow

    CVE-2023-50230

        Phone Book Access profile Heap-based Buffer Overflow

    For Debian 11 bullseye, these problems have been fixed in version     5.55-3.1+deb11u2.

    We recommend that you upgrade your bluez packages.

    For the detailed security status of bluez please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/bluez

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the bluez package has been released.

According to the versions of the bluez packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - BlueZ before 5.59 allows physically proximate attackers to obtain sensitive information because     profiles/audio/avrcp.c does not validate params_len. (CVE-2022-39176)

  - BlueZ before 5.59 allows physically proximate attackers to cause a denial of service because malformed and     invalid capabilities can be processed in profiles/audio/avdtp.c. (CVE-2022-39177)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the bluez package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in bluetoothd in BlueZ through 5.48. The vulnerability lies in the handling of a     SVC_ATTR_REQ by the SDP implementation. By crafting a malicious CSTATE, it is possible to trick the server     into returning more bytes than the buffer actually holds, resulting in leaking arbitrary heap data. The     root cause can be found in the function service_attr_req of sdpd-request.c. The server does not check     whether the CSTATE data is the same in consecutive requests, and instead simply trusts that it is the     same. (CVE-2019-8921)

  - A heap overflow vulnerability was found in bluez in versions prior to 5.63. An attacker with local network     access could pass specially crafted files causing an application to halt or crash, leading to a denial of     service. (CVE-2022-0204)

  - BlueZ before 5.59 allows physically proximate attackers to obtain sensitive information because     profiles/audio/avrcp.c does not validate params_len. (CVE-2022-39176)

  - BlueZ before 5.59 allows physically proximate attackers to cause a denial of service because malformed and     invalid capabilities can be processed in profiles/audio/avdtp.c. (CVE-2022-39177)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the bluez packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - BlueZ before 5.59 allows physically proximate attackers to obtain sensitive information because     profiles/audio/avrcp.c does not validate params_len. (CVE-2022-39176)

  - BlueZ before 5.59 allows physically proximate attackers to cause a denial of service because malformed and     invalid capabilities can be processed in profiles/audio/avdtp.c. (CVE-2022-39177)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0156-1 advisory.

    - CVE-2022-39176: Fixed a memory safety issue that could allow       physically proximate attackers to obtain sensitive information       (bsc#1203121).
    - CVE-2022-39177: Fixed a memory safety issue that could allow       physically proximate attackers to cause a denial of service       (bsc#1203120).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED12 / SLED_SAP12 / SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0166-1 advisory.

    - CVE-2022-39176: Fixed a memory safety issue that could allow       physically proximate attackers to obtain sensitive information       (bsc#1203121).
    - CVE-2022-39177: Fixed a memory safety issue that could allow       physically proximate attackers to cause a denial of service       (bsc#1203120).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0168-1 advisory.

    - CVE-2022-39176: Fixed a memory safety issue that could allow       physically proximate attackers to obtain sensitive information       (bsc#1203121).
    - CVE-2022-39177: Fixed a memory safety issue that could allow       physically proximate attackers to cause a denial of service       (bsc#1203120).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0155-1 advisory.

    - CVE-2022-39176: Fixed a memory safety issue that could allow       physically proximate attackers to obtain sensitive information       (bsc#1203121).
    - CVE-2022-39177: Fixed a memory safety issue that could allow       physically proximate attackers to cause a denial of service       (bsc#1203120).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of bluez installed on the remote host is prior to 5.44-7. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1881 advisory.

    2023-06-07: CVE-2022-39177 was added to this advisory.

    A vulnerability was found in BlueZ. This flaw allows physically proximate attackers to cause a denial of     service due to malformed and invalid capabilities processed in profiles/audio/avdtp.c. (CVE-2022-39177)

    A vulnerability was found in BlueZ. This flaw allows physically proximate attackers to obtain sensitive     information because the profiles/audio/avrcp.c does not validate params_len. (CVE-2022-39176)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3157 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3157-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Sylvain Beucler     October 24, 2022                              https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : bluez     Version        : 5.50-1.2~deb10u3     CVE ID         : CVE-2019-8921 CVE-2019-8922 CVE-2021-41229 CVE-2021-43400                      CVE-2022-0204 CVE-2022-39176 CVE-2022-39177     Debian Bug     : 998626 1000262 1003712

    Several vulnerabilities were discovered in BlueZ, the Linux Bluetooth     protocol stack. An attacker could cause a denial-of-service (DoS) or     leak information.

    CVE-2019-8921

        SDP infoleak, the vulnerability lies in the handling of a         SVC_ATTR_REQ by the SDP implementation of BlueZ. By crafting a         malicious CSTATE, it is possible to trick the server into         returning more bytes than the buffer actually holds, resulting in         leaking arbitrary heap data.

    CVE-2019-8922

        SDP Heap Overflow; this vulnerability lies in the SDP protocol         handling of attribute requests as well. By requesting a huge         number of attributes at the same time, an attacker can overflow         the static buffer provided to hold the response.

    CVE-2021-41229

        sdp_cstate_alloc_buf allocates memory which will always be hung in         the singly linked list of cstates and will not be freed. This will         cause a memory leak over time. The data can be a very large         object, which can be caused by an attacker continuously sending         sdp packets and this may cause the service of the target device to         crash.

    CVE-2021-43400

        A use-after-free in gatt-database.c can occur when a client         disconnects during D-Bus processing of a WriteValue call.

    CVE-2022-0204

        A heap overflow vulnerability was found in bluez. An attacker with         local network access could pass specially crafted files causing an         application to halt or crash, leading to a denial of service.

    CVE-2022-39176

        BlueZ allows physically proximate attackers to obtain sensitive         information because profiles/audio/avrcp.c does not validate         params_len.

    CVE-2022-39177

        BlueZ allows physically proximate attackers to cause a denial of         service because malformed and invalid capabilities can be         processed in profiles/audio/avdtp.c.

    For Debian 10 buster, these problems have been fixed in version     5.50-1.2~deb10u3.

    We recommend that you upgrade your bluez packages.

    For the detailed security status of bluez please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/bluez

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
361229	CentOS Linux 7 [TuxCare] Security Update: bluez / bluez-cups / bluez-hid2hci / bluez-libs / bluez-libs-devel Multiple Vulnerabilities (CENTOS7:CLSA-2026:1777541445)	Nessus	CentOS Local Security Checks	Local	high
357505	Rocky Linux 8.6 [CIQ] Security Update: bluez / bluez-cups / bluez-cups-debuginfo / bluez-debuginfo / etc Multiple Vulnerabilities (ciqsa-2026_0008)	Nessus	Rocky Linux Local Security Checks	Local	high
348967	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: bluez (UTSA-2026-054066)	Nessus	Unity Linux Local Security Checks	Local	high
267849	Unity Linux 20.1070e Security Update: bluez (UTSA-2025-680605)	Nessus	Unity Linux Local Security Checks	Local	high
225014	Linux Distros Unpatched Vulnerability : CVE-2022-39176	Nessus	Misc.	Local	high
206762	Debian dla-3879 : bluetooth - security update	Nessus	Debian Local Security Checks	Local	critical
204625	Photon OS 3.0: Bluez PHSA-2022-3.0-0453	Nessus	PhotonOS Local Security Checks	Local	high
203333	Photon OS 4.0: Bluez PHSA-2022-4.0-0245	Nessus	PhotonOS Local Security Checks	Local	high
178895	EulerOS Virtualization 3.0.6.6 : bluez (EulerOS-SA-2023-2406)	Nessus	Huawei Local Security Checks	Local	high
175202	EulerOS Virtualization 3.0.2.0 : bluez (EulerOS-SA-2023-1742)	Nessus	Huawei Local Security Checks	Local	high
172279	EulerOS 2.0 SP5 : bluez (EulerOS-SA-2023-1491)	Nessus	Huawei Local Security Checks	Local	high
170721	SUSE SLES15 Security Update : bluez (SUSE-SU-2023:0156-1)	Nessus	SuSE Local Security Checks	Local	high
170720	SUSE SLED12 / SLES12 Security Update : bluez (SUSE-SU-2023:0166-1)	Nessus	SuSE Local Security Checks	Local	high
170716	SUSE SLES15 Security Update : bluez (SUSE-SU-2023:0168-1)	Nessus	SuSE Local Security Checks	Local	high
170710	SUSE SLES15 Security Update : bluez (SUSE-SU-2023:0155-1)	Nessus	SuSE Local Security Checks	Local	high
168444	Amazon Linux 2 : bluez (ALAS-2022-1881)	Nessus	Amazon Linux Local Security Checks	Local	high
166429	Debian dla-3157 : bluetooth - security update	Nessus	Debian Local Security Checks	Local	critical

Detections

Analytics

CVE-2022-39176

high

Tenable Plugins

high

high

high

high

high

critical

high

high

high

high

high

high

high

high

high

high

critical