USN-6540-1: BlueZ vulnerability
It was discovered that BlueZ did not properly restrict non-bonded devices from injecting HID events into the input subsystem. This could allow a physically proximate attacker to inject keystrokes and execute arbitrary commands whilst the device is discoverable.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this BlueZ vulnerability?
The vulnerability ID for this BlueZ vulnerability is USN-6540-1.
What is the impact of this vulnerability?
This vulnerability could allow a physically proximate attacker to inject keystrokes and execute arbitrary commands.
Which software versions are affected by this vulnerability?
The affected software versions are BlueZ 5.68-0ubuntu1.1, BlueZ 5.66-0ubuntu1.1, BlueZ 5.64-0ubuntu1.1, BlueZ 5.53-0ubuntu3.7, BlueZ 5.48-0ubuntu3.9+esm1, and BlueZ 5.37-0ubuntu5.3+esm3.
How can I fix this BlueZ vulnerability?
To fix this vulnerability, update BlueZ to version 5.68-0ubuntu1.1 or later.
Where can I find more information about this vulnerability?
You can find more information about this vulnerability on the Ubuntu security website and the referenced Launchpad pages.