CVE-2022-31213
An issue was discovered in dbus-broker before 31. Multiple NULL pointer dereferences can be found...
An issue was discovered in dbus-broker before 31. Multiple NULL pointer dereferences can be found when supplying a malformed XML config file.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An issue was discovered in dbus-broker before 31. Multiple NULL pointer dereferences can be found when supplying a malformed XML config file.
- Record
CVE-2022-31213- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-476
- Updated
- 2026-11-02
CVE List No score
An issue was discovered in dbus-broker before 31. Multiple NULL pointer dereferences can be found when supplying a malformed XML config file.
- Record
CVE-2022-31213- Updated
- 2026-11-02
EUVDEUVD-2022-52797 No score
An issue was discovered in dbus-broker before 31. Multiple NULL pointer dereferences can be found when supplying a malformed XML config file.
- Record
EUVD-2022-52797- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-xwvh-5vg2-56cj
An issue was discovered in dbus-broker before 31. Multiple NULL pointer dereferences can be found...
An issue was discovered in dbus-broker before 31. Multiple NULL pointer dereferences can be found when supplying a malformed XML config file.
- Record
GHSA-xwvh-5vg2-56cj- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-476
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2022-31213
An issue was discovered in dbus-broker before 31. Multiple NULL pointer dereferences can be found when supplying a malformed XML config file.
- Record
DEBIAN-CVE-2022-31213- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
OSVOESA-2022-2116
dbus-broker security update
Security Fix(es):
An issue was discovered in dbus-broker before 31. It depends on c-uitl/c-shquote to parse the DBus service's Exec line. c-shquote contains a stack-based buffer over-read if a malicious Exec line is supplied.(CVE-2022-31212)
An issue was discovered in dbus-broker before 31. Multiple NULL pointer dereferences can be found when supplying a malformed XML config file.(CVE-2022-31213)
- Record
OESA-2022-2116- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 6 moreShow less
OSVRHSA-2022:6608
Red Hat Security Advisory: dbus-broker security update
- Record
RHSA-2022:6608- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRLSA-2022:6608
Moderate: dbus-broker security update
dbus-broker is an implementation of a message bus as defined by the D-Bus specification. Its aim is to provide high performance and reliability, while keeping compatibility to the D-Bus reference implementation. It is exclusively written for Linux systems, and makes use of many modern features provided by recent Linux kernel releases.
Security Fix(es):
-
dbus-broker: a stack buffer over-read if a malicious Exec line is supplied (CVE-2022-31212)
-
dbus-broker: null pointer reference when supplying a malformed XML config file (CVE-2022-31213)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2022:6608- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2022-31213
An issue was discovered in dbus-broker before 31. Multiple NULL pointer dereferences can be found when supplying a malformed XML config file.
- Record
UBUNTU-CVE-2022-31213- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVALSA-2022:6608 No score
Moderate: dbus-broker security update
dbus-broker is an implementation of a message bus as defined by the D-Bus specification. Its aim is to provide high performance and reliability, while keeping compatibility to the D-Bus reference implementation. It is exclusively written for Linux systems, and makes use of many modern features provided by recent Linux kernel releases.
Security Fix(es):
- dbus-broker: a stack buffer over-read if a malicious Exec line is supplied (CVE-2022-31212)
- dbus-broker: null pointer reference when supplying a malformed XML config file (CVE-2022-31213)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2022:6608- Updated
- 2026-11-02
OSV No score
An issue was discovered in dbus-broker before 31. Multiple NULL pointer dereferences can be found when supplying a malformed XML config file.
- Record
CVE-2022-31213- Updated
- 2026-11-02
OSVopenSUSE-SU-2022:10030-1 No score
Security update for dbus-broker
This update for dbus-broker fixes the following issues:
- CVE-2022-31212: Fix a stack buffer over-read in bundled c-shquote (boo#1200332)
- CVE-2022-31213: Fix a NULL pointer dereferences in bundled c-shquote (boo#1200333)
- Record
openSUSE-SU-2022:10030-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
dbus-brokerAlmaLinux:9 From an advisory covering 2 CVEs |
before 28-5.1.el9_0 | 28-5.1.el9_0 |
dbus-brokerDebian:12 |
before 30-1 | 30-1 |
dbus-brokerDebian:13 |
before 30-1 | 30-1 |
dbus-brokerDebian:14 |
before 30-1 | 30-1 |
dbus-brokeropenEuler:22.03-LTS From an advisory covering 2 CVEs |
before 29-4.oe2203 | 29-4.oe2203 |
dbus-brokerRed Hat:enterprise_linux:9::baseos From an advisory covering 2 CVEs |
before 0:28-5.1.el9_0 | 0:28-5.1.el9_0 |
dbus-broker-debuginfoRed Hat:enterprise_linux:9::baseos From an advisory covering 2 CVEs |
before 0:28-5.1.el9_0 | 0:28-5.1.el9_0 |
dbus-broker-debugsourceRed Hat:enterprise_linux:9::baseos From an advisory covering 2 CVEs |
before 0:28-5.1.el9_0 | 0:28-5.1.el9_0 |
dbus-brokerRocky Linux:9 From an advisory covering 2 CVEs |
before 0:28-5.1.el9 | 0:28-5.1.el9 |
dbus-brokerUbuntu:22.04:LTS |
All versions, plus listed versions 29-129-329-429-4build1 |
None known |
dbus-brokerSUSE:Package Hub 15 SP4 From an advisory covering 2 CVEs |
before 28-bp154.2.3.1 | 28-bp154.2.3.1 |
dbus-brokeropenSUSE:Leap 15.4 From an advisory covering 2 CVEs |
before 28-bp154.2.3.1 | 28-bp154.2.3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-31213 is a high vulnerability (CVSS 7.5) in Dbus-broker Project Dbus-broker, published June 25, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.29%, the 83rd percentile. Fixed in dbus-broker 30-1.
References
github.com/bus1/dbus-broker/compare/v30...v31
sec-consult.com/vulnerability-lab/advisory/memory-corruption-vulnerabilities-dbus-broker
security.gentoo.org/glsa/202305-04
nvd.nist.gov/vuln/detail/CVE-2022-31213
access.redhat.com/errata/RHSA-2022:6608
Show 22 moreShow less
bugzilla.redhat.com/2094718
errata.almalinux.org/9/ALSA-2022-6608.html
security-tracker.debian.org/tracker/CVE-2022-31213
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-2116
security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_6608.json
cve.org/CVERecord?id=CVE-2022-31212
errata.rockylinux.org/RLSA-2022:6608
ubuntu.com/security/CVE-2022-31213
lists.opensuse.org/archives/list/[email protected]/thread/YTBI3SDSIZY573CYLJALIS2TB3K6ZYEN
bugzilla.suse.com/1200332
suse.com/security/cve/CVE-2022-31212