{"id":"CVE-2022-0204","aliases":["CLSA-2026-1777541445","DEBIAN-CVE-2022-0204","DLA-3157-1","DLA-3879-1","EUVD-2022-15406","GHSA-479m-xcq5-9g2q","GHSA-g2fr-rq52-c2h3","MGASA-2022-0058","OESA-2022-1595","SUSE-SU-2022:2837-1","SUSE-SU-2022:2883-1","SUSE-SU-2022:2948-1","SUSE-SU-2022:3247-1","UBUNTU-CVE-2022-0204","USN-5275-1","openSUSE-SU-2024:12394-1"],"status":"published","title":"A heap overflow vulnerability was found in bluez in versions prior to 5.63. An attacker with...","description":"A heap overflow vulnerability was found in bluez in versions prior to 5.63. An attacker with local network access could pass specially crafted files causing an application to halt or crash, leading to a denial of service.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01793,"percentile":0.78558,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119","CWE-190","CWE-787"],"published":"2022-01-24T00:00:00Z","modified":"2026-11-03T08:00:09Z","fixes":[{"ecosystem":"Debian:12","package":"bluez","fixed_in":["5.64-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"bluez","fixed_in":["5.64-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"bluez","fixed_in":["5.64-1"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"bluez","fixed_in":["5.55-3.4.mga8"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"bluez","fixed_in":["5.54-9.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP2","package":"bluez","fixed_in":["5.54-9.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"bluez","fixed_in":["5.54-9.oe1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"bluez","fixed_in":["5.48-150000.5.31.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"bluez","fixed_in":["5.48-150000.5.31.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"bluez","fixed_in":["5.48-150000.5.31.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"bluez","fixed_in":["5.48-150000.5.31.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"bluez","fixed_in":["5.48-150000.5.31.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"bluez","fixed_in":["5.48-150000.5.31.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"bluez","fixed_in":["5.48-150000.5.31.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"bluez","fixed_in":["5.48-150000.5.31.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"bluez","fixed_in":["5.48-150000.5.31.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 6","package":"bluez","fixed_in":["5.48-150000.5.31.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"bluez","fixed_in":["5.55-150300.3.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP3","package":"bluez","fixed_in":["5.55-150300.3.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP3","package":"bluez","fixed_in":["5.55-150300.3.11.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"bluez","fixed_in":["5.55-150300.3.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"bluez","fixed_in":["5.62-150400.4.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP4","package":"bluez","fixed_in":["5.62-150400.4.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP4","package":"bluez","fixed_in":["5.62-150400.4.5.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"bluez","fixed_in":["5.62-150400.4.5.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"bluez","fixed_in":["5.37-0ubuntu5.3+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"bluez","fixed_in":["5.48-0ubuntu3.8"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"bluez","fixed_in":["5.53-0ubuntu3.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"bluez","fixed_in":["5.63-0ubuntu1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"bluez","fixed_in":["5.65-3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.44-7.el7.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"bluez-cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.44-7.el7.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"bluez-hid2hci","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.44-7.el7.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"bluez-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.44-7.el7.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"bluez-libs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.44-7.el7.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.64-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.64-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.64-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.50-1.2~deb10u3"}]}],"versions":["5.50-1","5.50-1.1","5.50-1.2~deb10u1","5.50-1.2~deb10u2"],"bundled":7},{"source":"osv","ecosystem":"Debian:11","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.55-3.1+deb11u2"}]}],"versions":["5.55-3.1","5.55-3.1+deb11u1"],"bundled":9},{"source":"osv","ecosystem":"Mageia:8","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.55-3.4.mga8"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.54-9.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP2","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.54-9.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.54-9.oe1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.48-150000.5.31.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.48-150000.5.31.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.48-150000.5.31.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.48-150000.5.31.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.48-150000.5.31.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.48-150000.5.31.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.48-150000.5.31.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.48-150000.5.31.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.48-150000.5.31.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.48-150000.5.31.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.55-150300.3.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP3","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.55-150300.3.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP3","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.55-150300.3.11.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.55-150300.3.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.48-150200.13.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.48-150200.13.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.48-150200.13.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.48-150200.13.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.48-150200.13.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.1","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.48-150200.13.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.48-150200.13.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 4.1","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.48-150200.13.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.48-150200.13.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.62-150400.4.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP4","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.62-150400.4.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP4","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.62-150400.4.5.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.62-150400.4.5.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.37-0ubuntu5.3+esm2"}]}],"versions":["5.35-0ubuntu2","5.36-0ubuntu1","5.37-0ubuntu5","5.37-0ubuntu5.1","5.37-0ubuntu5.3","5.37-0ubuntu5.3+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.48-0ubuntu3.8"}]}],"versions":["5.46-0ubuntu3","5.46-0ubuntu4","5.48-0ubuntu3","5.48-0ubuntu3.1","5.48-0ubuntu3.2","5.48-0ubuntu3.3","5.48-0ubuntu3.4","5.48-0ubuntu3.5","5.48-0ubuntu3.6","5.48-0ubuntu3.7"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.53-0ubuntu3.5"}]}],"versions":["5.50-0ubuntu4","5.51-0ubuntu1","5.51-0ubuntu2","5.52-0ubuntu1","5.52-0ubuntu2","5.53-0ubuntu1","5.53-0ubuntu2","5.53-0ubuntu3","5.53-0ubuntu3.1","5.53-0ubuntu3.2","5.53-0ubuntu3.3","5.53-0ubuntu3.4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.63-0ubuntu1"}]}],"versions":["5.60-0ubuntu2","5.62-0ubuntu1","5.62-0ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.37-0ubuntu5.3+esm2"}]}],"versions":["5.35-0ubuntu2","5.36-0ubuntu1","5.37-0ubuntu5","5.37-0ubuntu5.1","5.37-0ubuntu5.3","5.37-0ubuntu5.3+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.48-0ubuntu3.8"}]}],"versions":["5.46-0ubuntu3","5.46-0ubuntu4","5.48-0ubuntu3","5.48-0ubuntu3.1","5.48-0ubuntu3.2","5.48-0ubuntu3.3","5.48-0ubuntu3.4","5.48-0ubuntu3.5","5.48-0ubuntu3.6","5.48-0ubuntu3.7"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.53-0ubuntu3.5"}]}],"versions":["5.50-0ubuntu4","5.51-0ubuntu1","5.51-0ubuntu2","5.52-0ubuntu1","5.52-0ubuntu2","5.53-0ubuntu1","5.53-0ubuntu2","5.53-0ubuntu3","5.53-0ubuntu3.1","5.53-0ubuntu3.2","5.53-0ubuntu3.3","5.53-0ubuntu3.4"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.65-3.1"}]}]}],"products":[{"vendor":"bluez","product":"bluez"},{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2039807","tags":["x_transferred","Issue Tracking","Patch","Third Party Advisory","report"]},{"url":"https://github.com/bluez/bluez/security/advisories/GHSA-479m-xcq5-9g2q","tags":["x_transferred","Exploit","Third Party Advisory","advisory","report"]},{"url":"https://github.com/bluez/bluez/commit/591c546c536b42bef696d027f64aa22434f8c3f0","tags":["x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://security.gentoo.org/glsa/202209-16","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/10/msg00026.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","article"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/09/msg00022.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0204","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-g2fr-rq52-c2h3"},{"url":"https://errata.tuxcare.com/els_os/centos7els/CLSA-2026-1777541445.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0204.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-0204","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2022-0058.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=30015","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5275-1","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1595","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20222837-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1194704","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-0204","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20222883-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20222948-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1193227","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8922","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223247-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-0204","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-0204","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-0204","description":"A heap overflow vulnerability was found in bluez in versions prior to 5.63. An attacker with local network access could pass specially crafted files causing an application to halt or crash, leading to a denial of service.","status":"published","published":"2022-03-09T00:00:00Z","modified":"2026-04-15T21:09:47.949Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:34:42.028422Z"}],"euvd":[{"id":"EUVD-2022-15406","description":"A heap overflow vulnerability was found in bluez in versions prior to 5.63. An attacker with local network access could pass specially crafted files causing an application to halt or crash, leading to a denial of service.","status":"published","published":"2022-03-09T00:00:00Z","modified":"2026-04-15T21:09:47Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:24:24.796113Z"}],"ghsa":[{"id":"GHSA-g2fr-rq52-c2h3","title":"A heap overflow vulnerability was found in bluez in versions prior to 5.63. An attacker with...","description":"A heap overflow vulnerability was found in bluez in versions prior to 5.63. An attacker with local network access could pass specially crafted files causing an application to halt or crash, leading to a denial of service.","status":"published","published":"2022-03-11T00:02:25Z","modified":"2025-11-04T18:30:38Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-119","CWE-190","CWE-787"],"updated_at":"2026-11-02T15:04:33.412684Z"}],"nvd":[{"id":"CVE-2022-0204","description":"A heap overflow vulnerability was found in bluez in versions prior to 5.63. An attacker with local network access could pass specially crafted files causing an application to halt or crash, leading to a denial of service.","status":"published","published":"2022-03-10T17:44:55.23Z","modified":"2026-06-17T04:20:08.667Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"2.0","score":5.8,"vector":"AV:A/AC:L/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-119","CWE-190"],"updated_at":"2026-11-02T14:07:13.7085Z"}],"osv":[{"id":"CVE-2022-0204","description":"A heap overflow vulnerability was found in bluez in versions prior to 5.63. An attacker with local network access could pass specially crafted files causing an application to halt or crash, leading to a denial of service.","status":"published","published":"2022-03-09T00:00:00Z","modified":"2026-10-28T10:23:11.271151846Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T15:44:22.824781Z"},{"id":"DEBIAN-CVE-2022-0204","description":"A heap overflow vulnerability was found in bluez in versions prior to 5.63. An attacker with local network access could pass specially crafted files causing an application to halt or crash, leading to a denial of service.","status":"published","published":"2022-03-10T17:44:55.23Z","modified":"2026-11-03T08:00:09.058786543Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T08:25:15.646766Z"},{"id":"OESA-2022-1595","title":"bluez security update","description":"This package provides all utilities for use in Bluetooth applications. The BLUETOOTH trademarks are owned by Bluetooth SIG, Inc., U.S.A.\r\n\r\nSecurity Fix(es):\r\n\r\nA heap overflow vulnerability was found in bluez in versions prior to 5.63. An attacker with local network access could pass specially crafted files causing an application to halt or crash, leading to a denial of service.(CVE-2022-0204)","status":"published","published":"2022-03-26T11:04:52Z","modified":"2026-08-18T01:15:58.516475391Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"UBUNTU-CVE-2022-0204","description":"A heap overflow vulnerability was found in bluez in versions prior to 5.63. An attacker with local network access could pass specially crafted files causing an application to halt or crash, leading to a denial of service.","status":"published","published":"2022-01-24T00:00:00Z","modified":"2026-04-27T09:15:34.518578Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:53:51.630172Z"},{"id":"CLSA-2026-1777541445","title":"bluez: Fix of 3 CVEs","description":"- CVE-2022-0204: fix heap overflow when appending prepare writes in gatt-server\n- CVE-2022-39176: fix not checking params_len in AVRCP vendordep PDU handling\n- CVE-2022-39177: fix accepting invalid/malformed capabilities in AVDTP","status":"published","published":"2026-05-02T01:09:55Z","modified":"2026-06-01T00:33:18.572463318Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"DLA-3157-1","title":"bluez - security update","status":"published","published":"2022-10-24T00:00:00Z","modified":"2026-03-09T01:20:16.94095Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"DLA-3879-1","title":"bluez - security update","status":"published","published":"2024-09-07T00:00:00Z","modified":"2026-03-09T01:18:30.227025Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"MGASA-2022-0058","title":"Updated bluez packages fix security vulnerability","description":"Ziming Zhang discovered that BlueZ incorrectly handled memory write\noperations in its gatt server. A remote attacker could possibly use this\nto cause BlueZ to crash leading to a denial of service, or potentially\nremotely execute code. (CVE-2022-0204)\n","status":"published","published":"2022-02-12T17:31:35Z","modified":"2026-04-16T04:40:54.851088632Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"openSUSE-SU-2024:12394-1","title":"bluez-5.65-3.1 on GA media","description":"These are all security issues fixed in the bluez-5.65-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:46:46.528323Z","updated_at":"2026-11-02T16:58:35.751245Z"},{"id":"SUSE-SU-2022:2837-1","title":"Security update for bluez","description":"This update for bluez fixes the following issues:\n\n- CVE-2022-0204: Fixed a buffer overflow in the implementation of the\n  gatt protocol (bsc#1194704).\n","status":"published","published":"2022-08-18T05:38:27Z","modified":"2026-02-04T04:07:16.080462Z","updated_at":"2026-11-02T15:53:50.965375Z"},{"id":"SUSE-SU-2022:2883-1","title":"Security update for bluez","description":"This update for bluez fixes the following issues:\n\n- CVE-2022-0204: Fixed a buffer overflow in the implementation of the\n  gatt protocol (bsc#1194704).\n","status":"published","published":"2022-08-24T08:35:44Z","modified":"2026-02-04T02:24:33.643003Z","updated_at":"2026-11-02T15:53:50.965375Z"},{"id":"SUSE-SU-2022:2948-1","title":"Security update for bluez","description":"This update for bluez fixes the following issues:\n\n- CVE-2022-0204: Fixed a buffer overflow in the implementation of the\n  gatt protocol (bsc#1194704).\n- CVE-2019-8922: Fixed a buffer overflow in the implementation of the\n  Service Discovery Protocol (bsc#1193227).\n","status":"published","published":"2022-08-31T07:19:00Z","modified":"2026-02-04T03:39:50.070867Z","updated_at":"2026-11-02T15:53:50.965375Z"},{"id":"SUSE-SU-2022:3247-1","title":"Security update for bluez","description":"This update for bluez fixes the following issues:\n\n- CVE-2022-0204: Fixed check if the prepare writes would append more than the allowed maximum attribute length (bsc#1194704).\n","status":"published","published":"2022-09-12T07:02:39Z","modified":"2026-02-04T03:58:08.910585Z","updated_at":"2026-11-02T15:53:50.965375Z"},{"id":"USN-5275-1","title":"bluez vulnerability","description":"Ziming Zhang discovered that BlueZ incorrectly handled memory write operations\nin its gatt server. A remote attacker could possibly use this to cause BlueZ to\ncrash leading to a denial of service, or potentially remotely execute code.\n(CVE-2022-0204)\n","status":"published","published":"2022-02-08T09:56:52Z","modified":"2026-06-25T13:31:00.98239896Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}