Debian Patches

Status for bluez/5.87-3

Patch Description Author Forwarded Bugs Origin Last update
work-around-Logitech-diNovo-Edge-keyboard-firmware-i.patch work around Logitech diNovo Edge keyboard firmware issue Nobuhiro Iwamatsu <iwamatsu@debian.org> no debian 2024-04-10
obex-Use-GLib-helper-function-to-manipulate-paths.patch [PATCH 1/5] obex: Use GLib helper function to manipulate paths
Instead of trying to do it by hand. This also makes sure that
relative paths aren't used by the agent.		 Bastien Nocera <hadess@hadess.net> no 2013-11-09
agent-Assert-possible-infinite-loop.patch [PATCH 4/5] agent: Assert possible infinite loop Bastien Nocera <hadess@hadess.net> no 2013-12-09
org.bluez.obex.service.in.patch Don't link to symlinked systemd user service Nobuhiro Iwamatsu <iwamatsu@debian.org> not-needed debian 2017-03-17
main.conf-Add-more-details-Closes-904212.patch main.conf: Add more datails (Closes: #904212) Nobuhiro Iwamatsu <iwamatsu@nigauri.org> no 2018-07-29
Add-HCI_TO_STR-macro-for-FIRMWARE_DIR.patch Add HCI_TO_STR macro for FIRMWARE_DIR
If the macro specified with -D is string, it cannot be expanded and an error
will occur. This adds HCI_TO_STR macro that expands as string and wraps it
when expanding FIRMWARE_DIR.

```
tools/hciattach_bcm43xx.c: In function ‘bcm43xx_init’:
<command-line>: error: expected expression before ‘/’ token
tools/hciattach_bcm43xx.c:352:34: note: in expansion of macro ‘FIRMWARE_DIR’
352 | if (bcm43xx_locate_patch(FIRMWARE_DIR, chip_name, fw_path)) {
| ^~~~~~~~~~~~
```		 Nobuhiro Iwamatsu <iwamatsu@debian.org> no 2023-08-06
0002-hostname-handle-chassis-type-handset.patch [PATCH 2/4] hostname: handle chassis type handset
This also corrects the link to the definition of the base class of
device field.		 Simon Fels <simon.fels@canonical.com> no 2015-10-12
CVE-2026-80186.patch eir: Fix stack buffer overflow when parsing the remote name
name2utf8() copies len bytes into a HCI_MAX_NAME_LENGTH + 2, so 250,
byte stack buffer without clamping len first.

eir_parse() only rejects a field once it runs past the end of the EIR
data, and that data is up to 255 bytes, so field_len can be 254 and the
data_len passed to name2utf8() can reach 253. strncpy() then writes 253
bytes into the 250 byte buffer and leaves it unterminated, so the
following g_strstrip() and g_strdup() also read past the end.

The EIR data comes from a remote device, either in an extended inquiry
response or in an advertising report, so the length is attacker
controlled.

Clamp len to HCI_MAX_NAME_LENGTH, which is what the local name is
limited to anyway, and what ad_replace_name() already clamps to.		 Luiz Augusto von Dentz <luiz.von.dentz@intel.com> no 2026-08-19
lp1759836.patch hid2hci: Fix udev rules for linux-4.14+
Since commit 1455cf8dbfd0 ("driver core: emit uevents when
device is bound to a driver") the kernel started emitting
"bind" and "unbind" uevents which confuse the hid2hci
udev rules.

The symptoms on an affected machine (Dell E5400 in my case)
include bluetooth devices not appearing and udev hogging
the cpu as it's busy processing a constant stream of these
"bind"+"unbind" uevents.

Change the udev rules not do anything except for "add" and
"change" events. This seems to cure my machine at least.

v2: Don't mess up "change" (Zbyszek)
Fix up the commit message a bit		 Ville Syrjälä <ville.syrjala@linux.intel.com> no debian upstream, https://lore.kernel.org/patchwork/patch/1021109/ 2018-12-04
raspi-bcm43xx-load-firmware.patch Patches for loading the bcm43xx firmware

Disables setting the UART interface speed *before* loading the firmware
(a later call sets the speed of the interface as requested).		 Simon Long <simon@raspberrypi.org> yes 2022-12-06
raspi-bcm43xx-3wire.patch Patches to add BCM43xx 3-wire variant

This patch adds the bcm43xx-3wire variant to the hciattach tool; this is
for use when the mini-UART (which lacks flow-control) is used instead of the
PL011 UART to drive the bluetooth module		 Simon Long <simon@raspberrypi.org> yes 2017-04-05
ubuntu_error_restart.patch restart the service on errors Sebastien Bacher <seb128@ubuntu.com> no 2020-04-03
CVE-2026-75032-part1.patch avrcp: Fix Out-of-Bounds Read in AVRCP GetFolderItems parsing
If the "Displayable Name Length" is much longer than the size of the PDU
packet we receive, then we might try to memcpy() past the end of the PDU
packet.

Be careful about clamping the name copying to the smallest of:
- length specified in the PDU
- left-over packet after the length field
- size of the string we'll copy it into

(cherry picked from commit bd8989620ed6e80755f06cfdb18f5b4a3913493c)		 Bastien Nocera <hadess@hadess.net> no 2026-08-14
CVE-2026-75032-part2.patch avrcp: Fix media/folder name not being set
*namelen was used before being set.

(cherry picked from commit 58088149872d014684a582fdb7ad01a5180c9bc5)		 Bastien Nocera <hadess@hadess.net> no 2026-08-17
CVE-2026-80185.patch sdp-xml: Fix crash caused by type confusion when parsing crafted SDP XML

When element_end() processes </attribute>, it frees ctx_data->stack_head
and clears the stack even if parsing is still nested inside a parent
container.

If a crafted ServiceRecord places a nested <attribute> inside <sequence>,
a later sibling scalar element such as <uint64> can become the new stack
head. When the closing </sequence> is then processed, compute_seq_size()
is reached without first validating that the current node is actually
a sequence.

sdp_data_t.val stores both scalar members such as uint64 and the
dataseq pointer in the same union. As a result, attacker-controlled
scalar data can be reinterpreted as a linked-list pointer and traversed
until bluetoothd crashes.

See https://github.com/bluez/bluez/security/advisories/GHSA-7mmr-gwqx-vc34		 Bastien Nocera <hadess@hadess.net> no 2026-08-12

All known versions for source package 'bluez'

Links