CVE catalog

CVE-2020-15238

blueman affected and fixed versions

Blueman is a GTK+ Bluetooth Manager. In Blueman before 2.1.4, the DhcpClient method of the D-Bus interface to blueman-mechanism is prone to an argument injection vulnerability. The impact highly depends on the system configuration. If Polkit-1 is disabled and for versions lower than 2.0.6, any local user can possibly exploit this. If Polkit-1 is enabled for version 2.0.6 and later, a possible attacker needs to be allowed to use the `org.blueman.dhcp.client` action. That is limited to users in the wheel group in the shipped rules file that do have the privileges anyway. On systems with ISC DHCP client (dhclient), attackers can pass arguments to `ip link` with the interface name that can e.g. be used to bring down an interface or add an arbitrary XDP/BPF program. On systems with dhcpcd and without ISC DHCP client, attackers can even run arbitrary scripts by passing `-c/path/to/script` as an interface name. Patches are included in 2.1.4 and master that change the DhcpClient D-Bus method(s) to accept BlueZ network object paths instead of network interface names. A backport to 2.0(.8) is also available. As a workaround, make sure that Polkit-1-support is enabled and limit privileges for the `org.blueman.dhcp.client` action to users that are able to run arbitrary commands as root anyway in /usr/share/polkit-1/rules.d/blueman.rules.

Severity: High · CVSS 7.1CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:L
Published: Oct 27, 2020, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 4.59% · Oct 27, 2026

Projects and upstream resources

[blueman][Source-reported homepage]

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / release	Package	Version	Status	Source
Debiantrixie	blueman	`2.1.4-1`	FixedDistribution-reported fixed boundary	[CVE-2020-15238]
Debiantrixie	blueman	`2.4.4-1`	Fixed	[CVE-2020-15238]
Debiansid	blueman	`2.1.4-1`	FixedDistribution-reported fixed boundary	[CVE-2020-15238]
Debiansid	blueman	`2.4.4-1`	Fixed	[CVE-2020-15238]
Debianforky	blueman	`2.1.4-1`	FixedDistribution-reported fixed boundary	[CVE-2020-15238]
Debianforky	blueman	`2.4.4-1`	Fixed	[CVE-2020-15238]
Debianbookworm	blueman	`2.1.4-1`	FixedDistribution-reported fixed boundary	[CVE-2020-15238]
Debianbookworm	blueman	`2.3.5-2`	Fixed	[CVE-2020-15238]

Showing 8 fix observations. All 24 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence

Distribution / release	Package	Version	Status	Source
UnknownRelease not reported	blueman	`2.1.4-1`	UnknownSource applicability is not established	Provider not reported
Debianbookworm	blueman	`2.1.4-1`	FixedDistribution-reported fixed boundary	[CVE-2020-15238]
Debianbookworm	blueman	`2.3.5-2`	Fixed	[CVE-2020-15238]
Debianforky	blueman	`2.1.4-1`	FixedDistribution-reported fixed boundary	[CVE-2020-15238]
Debianforky	blueman	`2.4.4-1`	Fixed	[CVE-2020-15238]
Debiansid	blueman	`2.1.4-1`	FixedDistribution-reported fixed boundary	[CVE-2020-15238]
Debiansid	blueman	`2.4.4-1`	Fixed	[CVE-2020-15238]
Debiantrixie	blueman	`2.1.4-1`	FixedDistribution-reported fixed boundary	[CVE-2020-15238]
Debiantrixie	blueman	`2.4.4-1`	Fixed	[CVE-2020-15238]
Opensuseleap 15.2	blueman	`2.1.4-bp152.2.3.1`	UnknownSource applicability is not established	[OPENSUSE-SU-2020:1997-1]Feb 4, 2026, 3:56:32 AM UTC
Susepackage hub 15 sp2	blueman	`2.1.4-bp152.2.3.1`	UnknownSource applicability is not established	[OPENSUSE-SU-2020:1997-1]Feb 4, 2026, 3:56:32 AM UTC
Susepackage hub 15 sp2	blueman	`2.1.4-bp152.2.6.1`	UnknownSource applicability is not established	[OPENSUSE-SU-2020:2024-1]Feb 4, 2026, 2:48:31 AM UTC
Ubuntu16.04	blueman	`2.0-1ubuntu1`	UnknownSource applicability is not established	[USN-4605-1]Feb 10, 2026, 4:41:58 AM UTC[UBUNTU-CVE-2020-15238]Feb 4, 2026, 4:04:13 AM UTC
Ubuntu16.04	blueman	`2.0.3-1ubuntu1`	UnknownSource applicability is not established	[USN-4605-1]Feb 10, 2026, 4:41:58 AM UTC[UBUNTU-CVE-2020-15238]Feb 4, 2026, 4:04:13 AM UTC
Ubuntu16.04	blueman	`2.0.4-1ubuntu1`	UnknownSource applicability is not established	[USN-4605-1]Feb 10, 2026, 4:41:58 AM UTC[UBUNTU-CVE-2020-15238]Feb 4, 2026, 4:04:13 AM UTC
Ubuntu16.04	blueman	`2.0.4-1ubuntu2`	UnknownSource applicability is not established	[USN-4605-1]Feb 10, 2026, 4:41:58 AM UTC[UBUNTU-CVE-2020-15238]Feb 4, 2026, 4:04:13 AM UTC
Ubuntu16.04	blueman	`2.0.4-1ubuntu2.1`	UnknownSource applicability is not established	[USN-4605-1]Feb 10, 2026, 4:41:58 AM UTC[UBUNTU-CVE-2020-15238]Feb 4, 2026, 4:04:13 AM UTC
Ubuntu18.04	blueman	`2.0.4-1ubuntu3`	UnknownSource applicability is not established	[USN-4605-1]Feb 10, 2026, 4:41:58 AM UTC[UBUNTU-CVE-2020-15238]Feb 4, 2026, 4:04:13 AM UTC
Ubuntu18.04	blueman	`2.0.5-1ubuntu1`	UnknownSource applicability is not established	[USN-4605-1]Feb 10, 2026, 4:41:58 AM UTC[UBUNTU-CVE-2020-15238]Feb 4, 2026, 4:04:13 AM UTC
Ubuntu18.04	blueman	`2.0.5-1ubuntu1.1`	UnknownSource applicability is not established	[USN-4605-1]Feb 10, 2026, 4:41:58 AM UTC[UBUNTU-CVE-2020-15238]Feb 4, 2026, 4:04:13 AM UTC
Ubuntu20.04	blueman	`2.0.8-1ubuntu1`	UnknownSource applicability is not established	[USN-4605-1]Feb 10, 2026, 4:41:58 AM UTC[UBUNTU-CVE-2020-15238]Feb 4, 2026, 4:04:13 AM UTC
Ubuntu20.04	blueman	`2.1.1-1`	UnknownSource applicability is not established	[USN-4605-1]Feb 10, 2026, 4:41:58 AM UTC[UBUNTU-CVE-2020-15238]Feb 4, 2026, 4:04:13 AM UTC
Ubuntu20.04	blueman	`2.1.2-1`	UnknownSource applicability is not established	[USN-4605-1]Feb 10, 2026, 4:41:58 AM UTC[UBUNTU-CVE-2020-15238]Feb 4, 2026, 4:04:13 AM UTC
Ubuntu20.04	blueman	`2.1.2-1ubuntu0.1`	UnknownSource applicability is not established	[USN-4605-1]Feb 10, 2026, 4:41:58 AM UTC[UBUNTU-CVE-2020-15238]Feb 4, 2026, 4:04:13 AM UTC

Original provider fields

{
  "package_releases": [
    {
      "name": "blueman",
      "status": "fixed",
      "release": "sid",
      "version": "2.4.4-1"
    },
    {
      "name": "blueman",
      "status": "fixed",
      "release": "forky",
      "version": "2.4.4-1"
    },
    {
      "name": "blueman",
      "status": "fixed",
      "release": "trixie",
      "version": "2.4.4-1"
    },
    {
      "name": "blueman",
      "status": "fixed",
      "release": "bookworm",
      "version": "2.3.5-2"
    }
  ],
  "fixed_versions": [
    {
      "bug": 973718,
      "name": "blueman",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "2.1.4-1"
    },
    {
      "bug": 973718,
      "name": "blueman",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "2.1.4-1"
    },
    {
      "bug": 973718,
      "name": "blueman",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": "2.1.4-1"
    },
    {
      "bug": 973718,
      "name": "blueman",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": "2.1.4-1"
    }
  ],
  "distribution_packages": [
    {
      "name": "blueman",
      "fixed_version": "2.1.4-1",
      "applicability_unknown": true
    },
    {
      "name": "blueman",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.0.4-1ubuntu2.1"
            }
          ]
        }
      ],
      "release": "16.04",
      "versions": [
        "2.0-1ubuntu1",
        "2.0.3-1ubuntu1",
        "2.0.4-1ubuntu1",
        "2.0.4-1ubuntu2"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/USN-4605-1",
      "fixed_version": "2.0.4-1ubuntu2.1",
      "provider_source": "pypi",
      "provider_record_id": "USN-4605-1",
      "provider_updated_at": "2026-02-10T04:41:58Z",
      "applicability_unknown": true
    },
    {
      "name": "blueman",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.0.5-1ubuntu1.1"
            }
          ]
        }
      ],
      "release": "18.04",
      "versions": [
        "2.0.4-1ubuntu3",
        "2.0.5-1ubuntu1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/USN-4605-1",
      "fixed_version": "2.0.5-1ubuntu1.1",
      "provider_source": "pypi",
      "provider_record_id": "USN-4605-1",
      "provider_updated_at": "2026-02-10T04:41:58Z",
      "applicability_unknown": true
    },
    {
      "name": "blueman",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.1.2-1ubuntu0.1"
            }
          ]
        }
      ],
      "release": "20.04",
      "versions": [
        "2.0.8-1ubuntu1",
        "2.1.1-1",
        "2.1.2-1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/USN-4605-1",
      "fixed_version": "2.1.2-1ubuntu0.1",
      "provider_source": "pypi",
      "provider_record_id": "USN-4605-1",
      "provider_updated_at": "2026-02-10T04:41:58Z",
      "applicability_unknown": true
    },
    {
      "name": "blueman",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.0.4-1ubuntu2.1"
            }
          ]
        }
      ],
      "release": "16.04",
      "versions": [
        "2.0-1ubuntu1",
        "2.0.3-1ubuntu1",
        "2.0.4-1ubuntu1",
        "2.0.4-1ubuntu2"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2020-15238",
      "fixed_version": "2.0.4-1ubuntu2.1",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2020-15238",
      "provider_updated_at": "2026-02-04T04:04:13.886967Z",
      "applicability_unknown": true
    },
    {
      "name": "blueman",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.0.5-1ubuntu1.1"
            }
          ]
        }
      ],
      "release": "18.04",
      "versions": [
        "2.0.4-1ubuntu3",
        "2.0.5-1ubuntu1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2020-15238",
      "fixed_version": "2.0.5-1ubuntu1.1",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2020-15238",
      "provider_updated_at": "2026-02-04T04:04:13.886967Z",
      "applicability_unknown": true
    },
    {
      "name": "blueman",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.1.2-1ubuntu0.1"
            }
          ]
        }
      ],
      "release": "20.04",
      "versions": [
        "2.0.8-1ubuntu1",
        "2.1.1-1",
        "2.1.2-1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2020-15238",
      "fixed_version": "2.1.2-1ubuntu0.1",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2020-15238",
      "provider_updated_at": "2026-02-04T04:04:13.886967Z",
      "applicability_unknown": true
    },
    {
      "name": "blueman",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.1.4-bp152.2.3.1"
            }
          ]
        }
      ],
      "release": "package hub 15 sp2",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2020:1997-1",
      "fixed_version": "2.1.4-bp152.2.3.1",
      "provider_source": "pypi",
      "provider_record_id": "OPENSUSE-SU-2020:1997-1",
      "provider_updated_at": "2026-02-04T03:56:32.813251Z",
      "applicability_unknown": true
    },
    {
      "name": "blueman",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.1.4-bp152.2.3.1"
            }
          ]
        }
      ],
      "release": "leap 15.2",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2020:1997-1",
      "fixed_version": "2.1.4-bp152.2.3.1",
      "provider_source": "pypi",
      "provider_record_id": "OPENSUSE-SU-2020:1997-1",
      "provider_updated_at": "2026-02-04T03:56:32.813251Z",
      "applicability_unknown": true
    },
    {
      "name": "blueman",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.1.4-bp152.2.6.1"
            }
          ]
        }
      ],
      "release": "package hub 15 sp2",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2020:2024-1",
      "fixed_version": "2.1.4-bp152.2.6.1",
      "provider_source": "pypi",
      "provider_record_id": "OPENSUSE-SU-2020:2024-1",
      "provider_updated_at": "2026-02-04T02:48:31.181024Z",
      "applicability_unknown": true
    }
  ]
}

[Debian bug #973718]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[blueman]Unknown
Source package: [blueman]
Details (2)
- 2.3.5-2+b1 · amd64 · bookworm
  Fixed · Fixed: 2.1.4-1
  dsa · blueman · debian · bookworm; dsa · blueman · debian · 12
- 2.3.5-2+b1 · arm64 · bookworm
  Fixed · Fixed: 2.1.4-1
  dsa · blueman · debian · bookworm; dsa · blueman · debian · 12

[Debian 13 (Trixie)]

[blueman]Unknown
Details (2)
- 2.4.4-1 · amd64 · trixie
  Fixed · Fixed: 2.1.4-1
  dsa · blueman · debian · 13
- 2.4.4-1 · arm64 · trixie
  Fixed · Fixed: 2.1.4-1
  dsa · blueman · debian · 13

Observed: Oct 23, 2026, 5:48:13 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]