CVE-2008-2374

src/sdp.c in bluez-libs 3.30 in BlueZ, and other bluez-libs before 3.34 and bluez-utils before 3.34 versions, does not validate string length fields in SDP packets, which allows remote SDP servers to cause a denial of service or possibly have unspecified other impact via a crafted length field that triggers excessive memory allocation or a buffer over-read.

• CWE-1284
• CWE-1284

• http://lists.opensuse.org/opensuse-security-announce/2008-09/msg00005.htmlThird Party Advisory
• http://secunia.com/advisories/30957Broken Link, Vendor Advisory
• http://secunia.com/advisories/31057Broken Link
• http://secunia.com/advisories/31833Broken Link
• http://secunia.com/advisories/32099Broken Link
• http://secunia.com/advisories/32279Broken Link
• http://secunia.com/advisories/34280Broken Link
• http://security.gentoo.org/glsa/glsa-200903-29.xmlThird Party Advisory
• http://sourceforge.net/mailarchive/message.php?msg_name=b32d44000806161327u680c290au54fd21f2fef1d58e%40mail.gmail.comBroken Link, Exploit
• http://www.bluez.org/bluez-334/Product
• http://www.mandriva.com/security/advisories?name=MDVSA-2008:145Broken Link
• http://www.redhat.com/support/errata/RHSA-2008-0581.htmlBroken Link
• http://www.securityfocus.com/bid/30105Broken Link, Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id?1020479Broken Link, Third Party Advisory, VDB Entry
• http://www.vupen.com/english/advisories/2008/2096/referencesBroken Link
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9973Broken Link
• https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00396.htmlMailing List
• https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00233.htmlMailing List
• http://lists.opensuse.org/opensuse-security-announce/2008-09/msg00005.htmlThird Party Advisory
• http://secunia.com/advisories/30957Broken Link, Vendor Advisory
• http://secunia.com/advisories/31057Broken Link
• http://secunia.com/advisories/31833Broken Link
• http://secunia.com/advisories/32099Broken Link
• http://secunia.com/advisories/32279Broken Link
• http://secunia.com/advisories/34280Broken Link
• http://security.gentoo.org/glsa/glsa-200903-29.xmlThird Party Advisory
• http://sourceforge.net/mailarchive/message.php?msg_name=b32d44000806161327u680c290au54fd21f2fef1d58e%40mail.gmail.comBroken Link, Exploit
• http://www.bluez.org/bluez-334/Product
• http://www.mandriva.com/security/advisories?name=MDVSA-2008:145Broken Link
• http://www.redhat.com/support/errata/RHSA-2008-0581.htmlBroken Link
• http://www.securityfocus.com/bid/30105Broken Link, Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id?1020479Broken Link, Third Party Advisory, VDB Entry
• http://www.vupen.com/english/advisories/2008/2096/referencesBroken Link
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9973Broken Link
• https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00396.htmlMailing List
• https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00233.htmlMailing List

Published

Jul 7, 2008

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2008-2368Red Hat Certificate System 7.2 stores passwords in cleartext…
• CVE-2008-2369manzier.pxt in Red Hat Network Satellite Server before 5.1.1…9.1
• CVE-2008-2370Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, an…
• CVE-2008-2371Heap-based buffer overflow in pcre_compile.c in the Perl-Com…
• CVE-2008-2372The Linux kernel 2.6.24 and 2.6.25 before 2.6.25.9 allows lo…
• CVE-2008-2373Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2008-2375Memory leak in a certain Red Hat deployment of vsftpd before…
• CVE-2008-2376Integer overflow in the rb_ary_fill function in array.c in R…
• CVE-2008-2377Use-after-free vulnerability in the _gnutls_handshake_hash_b…
• CVE-2008-2378Untrusted search path vulnerability in hfkernel in hf 0.7.3 …
• CVE-2008-2379Cross-site scripting (XSS) vulnerability in SquirrelMail bef…
• CVE-2008-2380SQL injection vulnerability in authpgsqllib.c in Courier-Aut…