Read the docs
TI-2008-02277 Aliases CVE-2008-2374GHSA-278x-6vg6-6g42

src/sdp.c in bluez-libs 3.30 in BlueZ, and other bluez-libs before 3.34 and bluez-utils…

Priority MEDIUM 56CWE-1284Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat.

Summary

src/sdp.c in bluez-libs 3.30 in BlueZ, and other bluez-libs before 3.34 and bluez-utils before 3.34 versions, does not validate string length fields in SDP packets, which allows remote SDP servers to cause a denial of service or possibly have unspecified other impact via a crafted length field that triggers excessive memory allocation or a buffer over-read.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.04287 91st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Red Hat: 1 advisory

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:bluez:bluez-libs:*:*:*:*:*:*:*:*before 3.34VulnerableBlueZ
cpe:2.3:a:bluez:bluez-utils:*:*:*:*:*:*:*:*before 3.34VulnerableBlueZ
cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*8VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:9:*:*:*:*:*:*:*9VulnerableFedoraproject
  • cpe:2.3:a:bluez:bluez-libs:*:*:*:*:*:*:*:* Versions before 3.34 Vulnerable ·BlueZ
  • cpe:2.3:a:bluez:bluez-utils:*:*:*:*:*:*:*:* Versions before 3.34 Vulnerable ·BlueZ
  • cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:* Versions 8 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:9:*:*:*:*:*:*:* Versions 9 Vulnerable ·Fedoraproject

Remediation

Red Hat 1 advisory

  • RHSA-2008:0581 Released 2008-07-14 · Red Hat rating Moderate
    bluez-libs and bluez-utils security update
    • Red Hat Enterprise Linux (v. 5 server) bluez-libs-3.7-1.1, bluez-libs-3.7-1.1.i386, bluez-libs-3.7-1.1.ia64 +13
    • Red Hat Enterprise Linux AS version 4 bluez-libs-2.10-3, bluez-libs-2.10-3.i386, bluez-libs-2.10-3.ia64 +13
    • Red Hat Enterprise Linux Desktop (v. 5 client) bluez-libs-3.7-1.1, bluez-libs-3.7-1.1.i386, bluez-utils-3.7-2.2 +3
    • Red Hat Enterprise Linux Desktop Workstation (v. 5 client) bluez-libs-3.7-1.1, bluez-libs-devel-3.7-1.1, bluez-libs-devel-3.7-1.1.i386
    • Red Hat Enterprise Linux Desktop version 4 bluez-libs-2.10-3, bluez-libs-2.10-3.i386, bluez-libs-devel-2.10-3 +5
    • Red Hat Enterprise Linux ES version 4 bluez-libs-2.10-3, bluez-libs-2.10-3.i386, bluez-libs-2.10-3.ia64 +9
    • Red Hat Enterprise Linux WS version 4 bluez-libs-2.10-3, bluez-libs-2.10-3.i386, bluez-libs-2.10-3.ia64 +9

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux (v. 5 server)Fixed RHSA-2008:0581
Red Hat Enterprise Linux AS version 4Fixed RHSA-2008:0581
Red Hat Enterprise Linux Desktop (v. 5 client)Fixed RHSA-2008:0581
Red Hat Enterprise Linux Desktop Workstation (v. 5 client)Fixed RHSA-2008:0581
Red Hat Enterprise Linux Desktop version 4Fixed RHSA-2008:0581
Red Hat Enterprise Linux ES version 4Fixed RHSA-2008:0581
Red Hat Enterprise Linux WS version 4Fixed RHSA-2008:0581

Timeline

  1. 2026-10-02 Threatist record created from CVE-2008-2374
  2. 2026-10-03 Alias added: GHSA-278x-6vg6-6g42

References

Exploit 1

Advisory 6

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences