CVE-2022-39176 Information disclosure in n/a
Physically proximate attackers can obtain sensitive information from BlueZ due to missing validation of parameter lengths in the AVRCP profile.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-39176?
CVE-2022-39176 is a high-severity vulnerability in Canonical Ubuntu Linux, published on 2 Sep 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
BlueZ before 5.59 allows physically proximate attackers to obtain sensitive information because profiles/audio/avrcp.c does not validate params_len.
Which versions are affected by CVE-2022-39176?
It affects 3 products.
Products include Bluez Bluez, Canonical Ubuntu Linux, Debian Debian Linux.
How do I fix CVE-2022-39176?
Upgrade to a fixed version.
Is CVE-2022-39176 being exploited?
There is no known exploitation of CVE-2022-39176 in the wild and no public exploit code.
Other vulnerabilities in Canonical Ubuntu Linux
Sources
Also known as DEBIAN-CVE-2022-39176, GHSA-4hw3-29f2-2c2f, UBUNTU-CVE-2022-39176.