Skip to contentSkip to conversation

package/bluez5_utils: security bump version to 5.47

PATCH New Bernd Kuhls 3 participants 3 messages Sep 16, 2017 – Oct 16, 2017

lore
Share & tools
lore

Bernd Kuhls

author
#0 lore raw

PATCH 1/1 package/bluez5_utils: security bump version to 5.47

Fixes CVE-2017-1000250 - All versions of the SDP server in BlueZ 5.46 and earlier are vulnerable to an information disclosure vulnerability which allows remote attackers to obtain sensitive information from the bluetoothd process memory. This vulnerability lies in the processing of SDP search attribute requests.

Signed-off-by Bernd Kuhls <[email protected]>
---
 package/bluez5_utils/bluez5_utils.hash | 2 +-
 package/bluez5_utils/bluez5_utils.mk   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)
package/bluez5_utils/bluez5_utils.hash +1 -1
index bc20d220b8..36791c9e6f 100644
@@ -1,2 +1,2 @@
 # From https://www.kernel.org/pub/linux/bluetooth/sha256sums.asc:
-sha256 ddab3d3837c1afb8ae228a94ba17709a4650bd4db24211b6771ab735c8908e28  bluez-5.46.tar.xz
+sha256 cf75bf7cd5d564f21cc4a2bd01d5c39ce425397335fd47d9bbe43af0a58342c8  bluez-5.47.tar.xz
package/bluez5_utils/bluez5_utils.mk +1 -1
index 13658cd050..1bc69691e4 100644
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-BLUEZ5_UTILS_VERSION = 5.46
+BLUEZ5_UTILS_VERSION = 5.47
 BLUEZ5_UTILS_SOURCE = bluez-$(BLUEZ5_UTILS_VERSION).tar.xz
 BLUEZ5_UTILS_SITE = $(BR2_KERNEL_MIRROR)/linux/bluetooth
 BLUEZ5_UTILS_INSTALL_STAGING = YES
Signature · 1 line
2.11.0
Applied
#1 lore raw

PATCH 1/1 package/bluez5_utils: security bump version to 5.47

Hello,

Quoted 11 lines · Bernd Kuhls

Fixes CVE-2017-1000250 - All versions of the SDP server in BlueZ 5.46 and earlier are vulnerable to an information disclosure vulnerability which allows remote attackers to obtain sensitive information from the bluetoothd process memory. This vulnerability lies in the processing of SDP search attribute requests.

Signed-off-by Bernd Kuhls <[email protected]>
---
 package/bluez5_utils/bluez5_utils.hash | 2 +-
 package/bluez5_utils/bluez5_utils.mk   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

Applied to master, thanks.

Thomas

Signature · 3 lines
Thomas Petazzoni, CTO, Free Electrons
Embedded Linux, Kernel and Android engineering
http://free-electrons.com
#2 lore raw

PATCH 1/1 package/bluez5_utils: security bump version to 5.47

In reply to Bernd Kuhls
Quoted 9 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line

"Bernd" == Bernd Kuhls <[email protected]> writes:

Fixes CVE-2017-1000250 - All versions of the SDP server in BlueZ 5.46 and earlier are vulnerable to an information disclosure vulnerability which allows remote attackers to obtain sensitive information from the bluetoothd process memory. This vulnerability lies in the processing of SDP search attribute requests.

Signed-off-by Bernd Kuhls <[email protected]>

Committed to 2017.08.x, thanks.

Signature · 1 line
Bye, Peter Korsgaard