CVE-2023-50229

HighCVSS 8.0/10Last modified Jun 17, 2026

Description

BlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious Bluetooth device.

The specific flaw exists within the handling of the Phone Book Access profile. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-20936.

Metrics

CVSS 3.1 8.0/10CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-122

Affected software

VendorProductVersions
BlueZBlueZ5.66
bluezbluez5.66

References

Timeline

Published
May 3, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-50238.8A vulnerability was found in Tongda OA 2017 and classified as critical. Affected by this issue is some unknown functionality of the file genCVE-2023-502308.0BlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent aCVE-2023-502319.6NETGEAR ProSAFE Network Management System saveNodeLabel Cross-Site Scripting Privilege Escalation Vulnerability. This vulnerability allows rCVE-2023-502328.8Inductive Automation Ignition getParams Argument Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers tCVE-2023-502338.8Inductive Automation Ignition getJavaExecutable Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote atCVE-2023-502347.8Hancom Office Cell XLS File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackCVE-2023-502357.8Hancom Office Show PPT File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackCVE-2023-502367.8A vulnerability has been identified in Polarion ALM (All versions < V2404.0). The affected product is vulnerable due to weak file and folderCVE-2023-502397.2Two stack-based buffer overflow vulnerabilities exist in the boa set_RadvdInterfaceParam functionality of Realtek rtl819x Jungle SDK v3.4.11CVE-2023-50244.8A vulnerability was found in Planno 23.04.04. It has been classified as problematic. This affects an unknown part of the component Comment HCVE-2023-502407.2Two stack-based buffer overflow vulnerabilities exist in the boa set_RadvdInterfaceParam functionality of Realtek rtl819x Jungle SDK v3.4.11CVE-2023-502437.2Two stack-based buffer overflow vulnerabilities exist in the boa formIpQoS functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially