Bluez · Bluez · CVE-2019-8922
**Name of the Vulnerable Software and Affected Versions**
BlueZ versions through 5.48
**Description**
A heap-based buffer overflow was discovered in the bluetoothd component of BlueZ. The issue is caused by the lack of size checks when appending data to the output buffer in the `service attr req` function, which is called by `process request` in `sdpd-request.c`. This allows a remote attacker to craft a request that can overflow the preallocated buffer, potentially impacting the confidentiality, integrity, and availability of protected information.
**Recommendations**
For BlueZ versions through 5.48, update to a version that contains a fix for this issue.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.