The clifeatread_cb() function in src/gatt-database.c does not perform bounds checks on the 'offset' variable before using it as an index into an array for reading.
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "5.53-0ubuntu3.2", "binary_name": "bluetooth" }, { "binary_version": "5.53-0ubuntu3.2", "binary_name": "bluez" }, { "binary_version": "5.53-0ubuntu3.2", "binary_name": "bluez-cups" }, { "binary_version": "5.53-0ubuntu3.2", "binary_name": "bluez-dbg" }, { "binary_version": "5.53-0ubuntu3.2", "binary_name": "bluez-hcidump" }, { "binary_version": "5.53-0ubuntu3.2", "binary_name": "bluez-obexd" }, { "binary_version": "5.53-0ubuntu3.2", "binary_name": "bluez-tests" }, { "binary_version": "5.53-0ubuntu3.2", "binary_name": "libbluetooth-dev" }, { "binary_version": "5.53-0ubuntu3.2", "binary_name": "libbluetooth3" }, { "binary_version": "5.53-0ubuntu3.2", "binary_name": "libbluetooth3-dbg" } ] }