Security update for bluez SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2022:3981-1 Final 1 1 2022-11-15T10:45:51Z current 2022-11-15T10:45:51Z 2022-11-15T10:45:51Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for bluez This update for bluez fixes the following issues: - CVE-2021-43400: Fixed use-after-free in gatt-database.c (bsc#1192394). - CVE-2021-3658: Fixed adapter incorrectly restoring discoverable state after powered down (bsc#1188859). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2022-3981,SUSE-SLE-Module-Basesystem-15-SP3-2022-3981,SUSE-SLE-Module-Desktop-Applications-15-SP3-2022-3981,SUSE-SLE-Product-WE-15-SP3-2022-3981,openSUSE-SLE-15.3-2022-3981 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2022/suse-su-20223981-1/ Link for SUSE-SU-2022:3981-1 https://lists.suse.com/pipermail/sle-security-updates/2022-November/012918.html E-Mail link for SUSE-SU-2022:3981-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1188859 SUSE Bug 1188859 https://bugzilla.suse.com/1192394 SUSE Bug 1192394 https://www.suse.com/security/cve/CVE-2021-3658/ SUSE CVE CVE-2021-3658 page https://www.suse.com/security/cve/CVE-2021-43400/ SUSE CVE CVE-2021-43400 page SUSE Linux Enterprise Module for Basesystem 15 SP3 SUSE Linux Enterprise Module for Desktop Applications 15 SP3 SUSE Linux Enterprise Workstation Extension 15 SP3 openSUSE Leap 15.3 bluez-5.55-150300.3.14.1 bluez-auto-enable-devices-5.55-150300.3.14.1 bluez-cups-5.55-150300.3.14.1 bluez-deprecated-5.55-150300.3.14.1 bluez-devel-5.55-150300.3.14.1 bluez-devel-32bit-5.55-150300.3.14.1 bluez-devel-64bit-5.55-150300.3.14.1 bluez-test-5.55-150300.3.14.1 libbluetooth3-5.55-150300.3.14.1 libbluetooth3-32bit-5.55-150300.3.14.1 libbluetooth3-64bit-5.55-150300.3.14.1 bluez-5.55-150300.3.14.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP3 bluez-deprecated-5.55-150300.3.14.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP3 libbluetooth3-5.55-150300.3.14.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP3 bluez-devel-5.55-150300.3.14.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP3 bluez-cups-5.55-150300.3.14.1 as a component of SUSE Linux Enterprise Workstation Extension 15 SP3 bluez-5.55-150300.3.14.1 as a component of openSUSE Leap 15.3 bluez-auto-enable-devices-5.55-150300.3.14.1 as a component of openSUSE Leap 15.3 bluez-cups-5.55-150300.3.14.1 as a component of openSUSE Leap 15.3 bluez-deprecated-5.55-150300.3.14.1 as a component of openSUSE Leap 15.3 bluez-devel-5.55-150300.3.14.1 as a component of openSUSE Leap 15.3 bluez-devel-32bit-5.55-150300.3.14.1 as a component of openSUSE Leap 15.3 bluez-test-5.55-150300.3.14.1 as a component of openSUSE Leap 15.3 libbluetooth3-5.55-150300.3.14.1 as a component of openSUSE Leap 15.3 libbluetooth3-32bit-5.55-150300.3.14.1 as a component of openSUSE Leap 15.3 bluetoothd from bluez incorrectly saves adapters' Discoverable status when a device is powered down, and restores it when powered up. If a device is powered down while discoverable, it will be discoverable when powered on again. This could lead to inadvertent exposure of the bluetooth stack to physically nearby attackers. CVE-2021-3658 SUSE Linux Enterprise Module for Basesystem 15 SP3:bluez-5.55-150300.3.14.1 SUSE Linux Enterprise Module for Basesystem 15 SP3:bluez-deprecated-5.55-150300.3.14.1 SUSE Linux Enterprise Module for Basesystem 15 SP3:libbluetooth3-5.55-150300.3.14.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP3:bluez-devel-5.55-150300.3.14.1 SUSE Linux Enterprise Workstation Extension 15 SP3:bluez-cups-5.55-150300.3.14.1 openSUSE Leap 15.3:bluez-5.55-150300.3.14.1 openSUSE Leap 15.3:bluez-auto-enable-devices-5.55-150300.3.14.1 openSUSE Leap 15.3:bluez-cups-5.55-150300.3.14.1 openSUSE Leap 15.3:bluez-deprecated-5.55-150300.3.14.1 openSUSE Leap 15.3:bluez-devel-32bit-5.55-150300.3.14.1 openSUSE Leap 15.3:bluez-devel-5.55-150300.3.14.1 openSUSE Leap 15.3:bluez-test-5.55-150300.3.14.1 openSUSE Leap 15.3:libbluetooth3-32bit-5.55-150300.3.14.1 openSUSE Leap 15.3:libbluetooth3-5.55-150300.3.14.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20223981-1/ https://www.suse.com/security/cve/CVE-2021-3658.html CVE-2021-3658 https://bugzilla.suse.com/1188859 SUSE Bug 1188859 An issue was discovered in gatt-database.c in BlueZ 5.61. A use-after-free can occur when a client disconnects during D-Bus processing of a WriteValue call. CVE-2021-43400 SUSE Linux Enterprise Module for Basesystem 15 SP3:bluez-5.55-150300.3.14.1 SUSE Linux Enterprise Module for Basesystem 15 SP3:bluez-deprecated-5.55-150300.3.14.1 SUSE Linux Enterprise Module for Basesystem 15 SP3:libbluetooth3-5.55-150300.3.14.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP3:bluez-devel-5.55-150300.3.14.1 SUSE Linux Enterprise Workstation Extension 15 SP3:bluez-cups-5.55-150300.3.14.1 openSUSE Leap 15.3:bluez-5.55-150300.3.14.1 openSUSE Leap 15.3:bluez-auto-enable-devices-5.55-150300.3.14.1 openSUSE Leap 15.3:bluez-cups-5.55-150300.3.14.1 openSUSE Leap 15.3:bluez-deprecated-5.55-150300.3.14.1 openSUSE Leap 15.3:bluez-devel-32bit-5.55-150300.3.14.1 openSUSE Leap 15.3:bluez-devel-5.55-150300.3.14.1 openSUSE Leap 15.3:bluez-test-5.55-150300.3.14.1 openSUSE Leap 15.3:libbluetooth3-32bit-5.55-150300.3.14.1 openSUSE Leap 15.3:libbluetooth3-5.55-150300.3.14.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20223981-1/ https://www.suse.com/security/cve/CVE-2021-43400.html CVE-2021-43400 https://bugzilla.suse.com/1192394 SUSE Bug 1192394