CVE-2022-0204

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A heap overflow vulnerability was found in bluez in versions prior to 5.63. An attacker with local network access could pass specially crafted files causing an application to halt or crash, leading to a denial of service.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119 CWE-190

Affected software

Vendor	Product	Versions
n/a	bluez	bluez versions prior to 5.63

References

https://bugzilla.redhat.com/show_bug.cgi?id=2039807Issue Tracking, Patch, Third Party Advisory
https://github.com/bluez/bluez/commit/591c546c536b42bef696d027f64aa22434f8c3f0Patch, Third Party Advisory
https://github.com/bluez/bluez/security/advisories/GHSA-479m-xcq5-9g2qExploit, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/10/msg00026.htmlMailing List, Third Party Advisory
https://security.gentoo.org/glsa/202209-16Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2039807Issue Tracking, Patch, Third Party Advisory
https://github.com/bluez/bluez/commit/591c546c536b42bef696d027f64aa22434f8c3f0Patch, Third Party Advisory
https://github.com/bluez/bluez/security/advisories/GHSA-479m-xcq5-9g2qExploit, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/10/msg00026.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2024/09/msg00022.html
https://security.gentoo.org/glsa/202209-16Third Party Advisory

Timeline

Published: Mar 10, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-02055.4The YOP Poll WordPress plugin before 6.3.5 does not sanitise and escape some of the settings (available to users with a role as low as autho CVE-2022-02066.1The NewStatPress WordPress plugin before 1.3.6 does not properly escape the whatX parameters before outputting them back in attributes, lead CVE-2022-02074.7A race condition was found in vdsm. Functionality to obfuscate sensitive values in log files that may lead to values being stored in clear t CVE-2022-02086.1The MapPress Maps for WordPress plugin before 2.73.4 does not sanitise and escape the mapid parameter before outputting it back in the "Bad CVE-2022-02094.8The Mitsol Social Post Feed WordPress plugin before 1.11 does not escape some of its settings before outputting them back in attributes, whi CVE-2022-02104.8The Random Banner WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the category parameter foun CVE-2022-02114.8The Shield Security WordPress plugin before 13.0.6 does not sanitise and escape admin notes, which could allow high privilege users to perfo CVE-2022-02126.1The SpiderCalendar WordPress plugin through 1.5.65 does not sanitise and escape the callback parameter before outputting it back in the page CVE-2022-02136.6vim is vulnerable to Heap-based Buffer Overflow CVE-2022-02147.5The Custom Popup Builder WordPress plugin before 1.3.1 autoload data from its popup on every pages, as such data can be sent by unauthentica CVE-2022-02158.8The Login/Signup Popup, Waitlist Woocommerce ( Back in stock notifier ), and Side Cart Woocommerce (Ajax) WordPress plugins by XootiX are vu CVE-2022-02164.4A use-after-free vulnerability was found in the LSI53C895A SCSI Host Bus Adapter emulation of QEMU. The flaw occurs while processing repeate