Issue metadata
Sign in to add a comment
|
CrOS: Vulnerability reported in net-wireless/bluez |
||||||||||||||||||||||
Issue descriptionAutomated analysis has detected that the following third party packages have had vulnerabilities publicly reported. NOTE: There may be several bugs listed below - in almost all cases, all bugs can be quickly addressed by upgrading to the latest version of the package. Package Name: net-wireless/bluez Package Version: [cpe:/a:bluez:bluez-libs:5.41 cpe:/a:bluez:bluez-libs:5.44 cpe:/a:bluez:bluez:5.41 cpe:/a:bluez:bluez:5.44] Advisory: CVE-2016-7837 Details: https://vomit.googleplex.com/advisory?id=CVE/CVE-2016-7837 CVSS severity score: 4.6/10.0 Confidence: high Description: Buffer overflow in BlueZ 5.41 and earlier allows an attacker to execute arbitrary code via the parse_line function used in some userland utilities.
,
Jun 19 2017
Sameer, who owns Bluetooth for CrOS?
,
Jun 19 2017
We've recently updated our bluez stack to 5.44. Dmitry, could you please take a look and see if it impacts 5.44 too?
,
Jun 19 2017
5.42 and later are not vulnerable it seems and not easily exploitable on chromeos as we do not allow arbitrary code to run bluez-utils apps
,
Jun 19 2017
Agreed. Marking WontFix. Thanks Sameer and Dmitry.
,
Jun 19 2017
,
Sep 26 2017
This bug has been closed for more than 14 weeks. Removing security view restrictions. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
|||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||
Comment 1 by est...@chromium.org
, Jun 17 2017Status: Assigned (was: Untriaged)