SUSE-SU-2024:0166-1

Details

Description of the patch:

This update for bluez fixes the following issues:

CVE-2021-41229: Fix leaking buffers stored in cstates cache (bsc#1192760).
CVE-2023-50229: Fixed an out of bounds write in the primary version counter for the Phone Book Access Profile implementation (bsc#1218300).
CVE-2023-50230: Fixed an out of bounds write in the secondary version counter for the Phone Book Access Profile implementation (bsc#1218301).

Affected Packages

bluez

SUSE Linux Enterprise High Performance Computing 15 SP1SUSE Linux Enterprise High Performance Computing 15 SP1-LTSSSUSE Linux Enterprise Server 15 SP1SUSE Linux Enterprise Server 15 SP1-LTSSSUSE Linux Enterprise Server for SAP Applications 15 SP1

Fixed in:

5.48-150000.5.54.1

bluez-devel

SUSE Linux Enterprise High Performance Computing 15 SP1SUSE Linux Enterprise High Performance Computing 15 SP1-LTSSSUSE Linux Enterprise Server 15 SP1SUSE Linux Enterprise Server 15 SP1-LTSSSUSE Linux Enterprise Server for SAP Applications 15 SP1

Fixed in:

5.48-150000.5.54.1

libbluetooth3

SUSE Linux Enterprise High Performance Computing 15 SP1SUSE Linux Enterprise High Performance Computing 15 SP1-LTSSSUSE Linux Enterprise Server 15 SP1SUSE Linux Enterprise Server 15 SP1-LTSSSUSE Linux Enterprise Server for SAP Applications 15 SP1

Fixed in:

5.48-150000.5.54.1

References

ADVISORY

https://bugzilla.suse.com/1192760

ADVISORY

https://bugzilla.suse.com/1218300

ADVISORY

https://bugzilla.suse.com/1218301

ADVISORY

https://lists.suse.com/pipermail/sle-security-updates/2024-January/017715.html

ADVISORY