Your message dated Mon, 07 Sep 2026 12:04:49 +0000
with message-id <[email protected]>
and subject line Bug#1145869: fixed in bluez 5.87-3
has caused the Debian Bug report #1145869,
regarding bluez; CVE-2026-80186
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1145869: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1145869
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: bluez
Version: 5.87-1
Severity: important
Tags: security upstream
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerability was published for bluez.
CVE-2026-80186[0]:
| A stack-based buffer overflow vulnerability exists in BlueZ, the
| Linux Bluetooth protocol stack. A remote user within Bluetooth radio
| range can send a specially crafted Extended Inquiry Response (EIR)
| packet that causes a buffer overflow when the target device performs
| Bluetooth discovery. This vulnerability can lead to a Denial of
| Service (DoS) by crashing the bluetoothd service and may allow for
| arbitrary code execution.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-80186
https://www.cve.org/CVERecord?id=CVE-2026-80186
[1] https://github.com/bluez/bluez/security/advisories/GHSA-68h6-5qgp-3975
[2]
https://github.com/bluez/bluez/commit/381b5d0d208972586282116d333865ba93b8dec2
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: bluez
Source-Version: 5.87-3
Done: Jeremy Bícha <[email protected]>
We believe that the bug you reported is fixed in the latest version of
bluez, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Jeremy Bícha <[email protected]> (supplier of updated bluez package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Mon, 07 Sep 2026 13:39:47 +0200
Source: bluez
Built-For-Profiles: derivative.ubuntu noudeb
Architecture: source
Version: 5.87-3
Distribution: unstable
Urgency: high
Maintainer: Debian Bluetooth Maintainers <[email protected]>
Changed-By: Jeremy Bícha <[email protected]>
Closes: 1145869 1145870
Changes:
bluez (5.87-3) unstable; urgency=high
.
* Team upload
* SECURITY UPDATE
- debian/patches/CVE-2026-80185:
Unprivileged-local and adjacent-LE-peer in src/sdp-xml.c
leads to arbitrary code execution as root
+ CVE-2026-80185 (Closes: #1145870)
- debian/patches/CVE-2026-80186:
Stack Overflow in name2utf8 in src/eir.c causes DoS and
potential code execution
+ CVE-2026-80186 (Closes: #1145869)
Checksums-Sha1:
742f62b7548e8336f7c99a4cdc7ebde5959afce9 2850 bluez_5.87-3.dsc
c2b177c2a57fde1236bb183414bf5b2e85c2fb59 39864 bluez_5.87-3.debian.tar.xz
c68a4331e8966b94ff3820267771c97d533a11f9 8128 bluez_5.87-3_source.buildinfo
Checksums-Sha256:
aabfcdacae8775b4b9a24eb6bab2336c4904740342ba54831508faea0a098a81 2850
bluez_5.87-3.dsc
fe1a9578cb506316c4656c92b876c2ecd66c52175c6f4967e3641ca155810315 39864
bluez_5.87-3.debian.tar.xz
80d23cd78d3aedaadb58cac2f3dbc5d7e71feb4225bd4b3e030d7a53d74545ca 8128
bluez_5.87-3_source.buildinfo
Files:
d0ea2c1d550ba21a253f683eafe8fa87 2850 admin optional bluez_5.87-3.dsc
312942ef07063f27cd2b9f374a9e8df2 39864 admin optional
bluez_5.87-3.debian.tar.xz
77465a6e5831a107e3a736b7135dba71 8128 admin optional
bluez_5.87-3_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEETQvhLw5HdtiqzpaW5mx3Wuv+bH0FAmqeoyMACgkQ5mx3Wuv+
bH2vLA//V/zGzDHx+xv6jFJ3wnGGMaV7DfJ3eCDS3IzazIAZhmstaqJC6/aAFADA
DZpkzqza2UEFUj6uDngREvl5I4C4cbx8l2B1ZVR65bS1gpq20xIhbyQ2NrTc2CsE
z8ujQOGsr8tOpSmRLfiJES2CaXWTsPGu0axFppfefPv8u06kxYU4YqMtYMJ9/E28
lCjUQNKwsaGj72ik4T6UA/P/9Y5LgTD+R9nQnEGnWFENt6U2Y2OE5/nk+D4N0POu
RULxfcacR76ANMw65Jl2FTnLiT6ytK5TDb7Fieu7KwJSPL/KMoCKtfB7/RbDM5FU
4A4iRaLJQHnJ7GOpo+ZQDEqO779Wz6+1+1SUu3L3Mn3j3w3JzP6xDx7JFLNAj36g
fMGfO2vja1bOjuyp0Urcqq0XJvENjOCUE1u1RzSdT6foTRpU6IYZwZPrGZOY9upu
SxQJcHtoxZZ29B1L0hAK9+C8d7Qr74UlEyxVfGOu0hp3cLiepLseJoQGm6N7uiCY
sLf/bQqHw48bOixSC3nx05+5cL97R/fT248JGrt4Ywt+J1wzrIldX0HyovR2FAFP
mXlFI0xIswN4+d6cul/bnCoi14EqkLDMP5ikM9q2ySE976RAqKZ/p2+jg5+HfU3z
uOTpMN6ZfYoWBLAWfdMIgL7klgKYRORc3hPnd77u69Gp4gPCQNw=
=1DFE
-----END PGP SIGNATURE-----
pgpYujE7XxwRW.pgp
Description: PGP signature
--- End Message ---
