CVE catalog
CVE-2020-10370
bluez-firmware: CVE-2020-10370
- Severity
- Medium · CVSS 5.8
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.56% · Oct 27, 2026
Certain Cypress (and Broadcom) Wireless Combo chips such as CYW43455, when a 2021-01-26 Bluetooth firmware update is not present, allow a Bluetooth outage via a "Spectra" attack.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | bluez-firmware | sid | 1.2-13 | not affected |
| Debian | bluez-firmware | forky | 1.2-13 | not affected |
| Debian | bluez-firmware | trixie | 1.2-13 | not affected |
| Debian | bluez-firmware | bookworm | 1.2-9 | not affected |
| Opensuse | bcm43xx-firmware | tumbleweed | 20180314-14.1 | fixed |
| Ubuntu | linux-firmware-raspi2 | pro | 1.20161020-0ubuntu1 | vulnerable |
| Ubuntu | linux-firmware-raspi2 | pro | 1.20180919-0ubuntu0.18.04.2 | vulnerable |
| Ubuntu | linux-firmware-raspi2 | pro | 1.20190215-0ubuntu0.18.04.1 | vulnerable |
| Ubuntu | linux-firmware-raspi2 | pro | 1.20190819-0ubuntu0.18.04.1 | vulnerable |
| Ubuntu | linux-firmware-raspi2 | pro | 1.20200601+arm64-0ubuntu2~18.04.1 | vulnerable |
| Ubuntu | linux-firmware-raspi2 | pro | 4-0ubuntu0~18.04.1 | vulnerable |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | bluez-firmware | source | sid | Not affected | unimportant | Not reported | Not reported |
| Debian | bluez-firmware | source | forky | Not affected | unimportant | Not reported | Not reported |
| Debian | bluez-firmware | source | trixie | Not affected | unimportant | Not reported | Not reported |
| Debian | bluez-firmware | source | bookworm | Not affected | unimportant | Not reported | Not reported |
| Opensuse | bcm43xx-firmware | rpm | tumbleweed | 20180314-14.1 | Not reported | OPENSUSE-SU-2024:11689-1 | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [bluez-firmware]Not affected
Details (2)
1.2-9· all · bookwormNot affected
dsa · bluez-firmware · debian · bookworm
1.2-9· all · bookwormNot affected
dsa · bluez-firmware · debian · bookworm
[openSUSE Tumbleweed]
- [bcm43xx-firmware]Fixed
Source package: [bcm43xx-firmware]
Details (1)
20180314-16.7· noarch · tumbleweedFixed · Fixed:
20180314-14.1dsa · bcm43xx-firmware · opensuse · tumbleweed
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_11689-1.json]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2020-10370]
- [https://osv.dev/vulnerability/openSUSE-SU-2024:11689-1]
- [https://security-tracker.debian.org/tracker/CVE-2020-10370]
- [https://security.access.redhat.com/data/csaf/v2/vex/2020/cve-2020-10370.json]
[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]