CVE-2022-0204
Published on: Not Yet Published
Last Modified on: 11/07/2022 06:53:00 PM UTC
Certain versions of Bluez from Bluez contain the following vulnerability:
A heap overflow vulnerability was found in bluez in versions prior to 5.63. An attacker with local network access could pass specially crafted files causing an application to halt or crash, leading to a denial of service.
- CVE-2022-0204 has been assigned by
[email protected] to track the vulnerability - currently rated as HIGH severity.
CVSS3 Score: 8.8 - HIGH
| Attack Vector ⓘ |
Attack Complexity |
Privileges Required |
User Interaction |
|---|---|---|---|
| ADJACENT_NETWORK | LOW | NONE | NONE |
| Scope | Confidentiality Impact |
Integrity Impact |
Availability Impact |
| UNCHANGED | HIGH | HIGH | HIGH |
CVSS2 Score: 5.8 - MEDIUM
| Access Vector ⓘ |
Access Complexity |
Authentication |
|---|---|---|
| ADJACENT_NETWORK | LOW | NONE |
| Confidentiality Impact |
Integrity Impact |
Availability Impact |
| PARTIAL | PARTIAL | PARTIAL |
CVE References
| Description | Tags ⓘ | Link |
|---|---|---|
| Heap overflow vulnerability in the implementation of the gatt protocol · Advisory · bluez/bluez · GitHub | github.com text/html |
MISC github.com/bluez/bluez/security/advisories/GHSA-479m-xcq5-9g2q |
| shared/gatt-server: Fix heap overflow when appending prepare writes · bluez/[email protected] · GitHub | github.com text/html |
MISC github.com/bluez/bluez/commit/591c546c536b42bef696d027f64aa22434f8c3f0 |
| BlueZ: Multiple Vulnerabilities (GLSA 202209-16) — Gentoo security | security.gentoo.org text/html |
GENTOO GLSA-202209-16 |
| [SECURITY] [DLA 3157-1] bluez security update | lists.debian.org text/html |
MLIST [debian-lts-announce] 20221024 [SECURITY] [DLA 3157-1] bluez security update |
| 2039807 – (CVE-2022-0204) CVE-2022-0204 bluez: heap-based buffer overflow in the implementation of the gatt protocol | bugzilla.redhat.com text/html |
MISC bugzilla.redhat.com/show_bug.cgi?id=2039807 |
Related QID Numbers
- 181160 Debian Security Update for bluez (DLA 3157-1)
- 198657 Ubuntu Security Notification for BlueZ Vulnerability (USN-5275-1)
- 671575 EulerOS Security Update for bluez (EulerOS-SA-2022-1557)
- 671653 EulerOS Security Update for bluez (EulerOS-SA-2022-1707)
- 671733 EulerOS Security Update for bluez (EulerOS-SA-2022-1784)
- 671735 EulerOS Security Update for bluez (EulerOS-SA-2022-1801)
- 671791 EulerOS Security Update for bluez (EulerOS-SA-2022-1858)
- 671795 EulerOS Security Update for bluez (EulerOS-SA-2022-1834)
- 671848 EulerOS Security Update for bluez (EulerOS-SA-2022-1882)
- 710631 Gentoo Linux BlueZ Multiple Vulnerabilities (GLSA 202209-16)
- 752482 SUSE Enterprise Linux Security Update for bluez (SUSE-SU-2022:2837-1)
- 752503 SUSE Enterprise Linux Security Update for bluez (SUSE-SU-2022:2883-1)
- 752524 SUSE Enterprise Linux Security Update for bluez (SUSE-SU-2022:2948-1)
- 752578 SUSE Enterprise Linux Security Update for bluez (SUSE-SU-2022:3247-1)
Known Affected Configurations (CPE V2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Bluez | Bluez | All | All | All | All |
| Operating System | Debian | Debian Linux | 10.0 | All | All | All |
| Operating System | Fedoraproject | Fedora | 35 | All | All | All |
- cpe:2.3:a:bluez:bluez:*:*:*:*:*:*:*:*:
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*:
- cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*:
No vendor comments have been submitted for this CVE
Social Mentions
| Source | Title | Posted (UTC) |
|---|---|---|
 @CVEreport |
cve.report/CVE-2022-0204 A heap overflow vulnerability was found in bluez in versions prior to 5.63. An attacker wi… twitter.com/i/web/status/1… | 2022-03-10 19:28:05 |