<?xml version="1.0" encoding="UTF-8"?>
<cvrfdoc xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:cvrf="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf" xmlns:cvrf-common="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/common" xmlns:cvssv2="http://scap.nist.gov/schema/cvss-v2/1.0" xmlns:cvssv3="https://www.first.org/cvss/cvss-v3.0.xsd" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:ns0="http://purl.org/dc/elements/1.1/" xmlns:prod="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod" xmlns:scap-core="http://scap.nist.gov/schema/scap-core/1.0" xmlns:sch="http://purl.oclc.org/dsdl/schematron" xmlns:vuln="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf">
  <DocumentTitle xml:lang="en">Security update for bluez</DocumentTitle>
  <DocumentType>SUSE Patch</DocumentType>
  <DocumentPublisher Type="Vendor">
    <ContactDetails>security@suse.de</ContactDetails>
    <IssuingAuthority>SUSE Security Team</IssuingAuthority>
  </DocumentPublisher>
  <DocumentTracking>
    <Identification>
      <ID>SUSE-SU-2022:2883-1</ID>
    </Identification>
    <Status>Final</Status>
    <Version>1</Version>
    <RevisionHistory>
      <Revision>
        <Number>1</Number>
        <Date>2022-08-24T08:35:44Z</Date>
        <Description>current</Description>
      </Revision>
    </RevisionHistory>
    <InitialReleaseDate>2022-08-24T08:35:44Z</InitialReleaseDate>
    <CurrentReleaseDate>2022-08-24T08:35:44Z</CurrentReleaseDate>
    <Generator>
      <Engine>cve-database/bin/generate-cvrf.pl</Engine>
      <Date>2017-02-24T01:00:00Z</Date>
    </Generator>
  </DocumentTracking>
  <DocumentNotes>
    <Note Title="Topic" Type="Summary" Ordinal="1" xml:lang="en">Security update for bluez</Note>
    <Note Title="Details" Type="General" Ordinal="2" xml:lang="en">This update for bluez fixes the following issues:

- CVE-2022-0204: Fixed a buffer overflow in the implementation of the
  gatt protocol (bsc#1194704).
</Note>
    <Note Title="Terms of Use" Type="Legal Disclaimer" Ordinal="3" xml:lang="en">The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).</Note>
    <Note Title="Patchnames" Type="Details" Ordinal="4" xml:lang="en">SUSE-2022-2883,SUSE-SLE-Module-Basesystem-15-SP3-2022-2883,SUSE-SLE-Module-Desktop-Applications-15-SP3-2022-2883,SUSE-SLE-Product-WE-15-SP3-2022-2883,openSUSE-SLE-15.3-2022-2883</Note>
  </DocumentNotes>
  <DocumentDistribution xml:lang="en">Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0)</DocumentDistribution>
  <DocumentReferences>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/update/announcement/2022/suse-su-20222883-1/</URL>
      <Description>Link for SUSE-SU-2022:2883-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://lists.suse.com/pipermail/sle-security-updates/2022-August/011982.html</URL>
      <Description>E-Mail link for SUSE-SU-2022:2883-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/security/rating/</URL>
      <Description>SUSE Security Ratings</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1194704</URL>
      <Description>SUSE Bug 1194704</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2022-0204/</URL>
      <Description>SUSE CVE CVE-2022-0204 page</Description>
    </Reference>
  </DocumentReferences>
  <ProductTree xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod">
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Module for Basesystem 15 SP3">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Module for Basesystem 15 SP3">
        <FullProductName ProductID="SUSE Linux Enterprise Module for Basesystem 15 SP3" CPE="cpe:/o:suse:sle-module-basesystem:15:sp3">SUSE Linux Enterprise Module for Basesystem 15 SP3</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Module for Desktop Applications 15 SP3">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Module for Desktop Applications 15 SP3">
        <FullProductName ProductID="SUSE Linux Enterprise Module for Desktop Applications 15 SP3" CPE="cpe:/o:suse:sle-module-desktop-applications:15:sp3">SUSE Linux Enterprise Module for Desktop Applications 15 SP3</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Workstation Extension 15 SP3">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Workstation Extension 15 SP3">
        <FullProductName ProductID="SUSE Linux Enterprise Workstation Extension 15 SP3" CPE="cpe:/o:suse:sle-we:15:sp3">SUSE Linux Enterprise Workstation Extension 15 SP3</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="openSUSE Leap 15.3">
      <Branch Type="Product Name" Name="openSUSE Leap 15.3">
        <FullProductName ProductID="openSUSE Leap 15.3" CPE="cpe:/o:opensuse:leap:15.3">openSUSE Leap 15.3</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Version" Name="bluez-5.55-150300.3.11.1">
      <FullProductName ProductID="bluez-5.55-150300.3.11.1">bluez-5.55-150300.3.11.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="bluez-auto-enable-devices-5.55-150300.3.11.1">
      <FullProductName ProductID="bluez-auto-enable-devices-5.55-150300.3.11.1">bluez-auto-enable-devices-5.55-150300.3.11.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="bluez-cups-5.55-150300.3.11.1">
      <FullProductName ProductID="bluez-cups-5.55-150300.3.11.1">bluez-cups-5.55-150300.3.11.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="bluez-deprecated-5.55-150300.3.11.1">
      <FullProductName ProductID="bluez-deprecated-5.55-150300.3.11.1">bluez-deprecated-5.55-150300.3.11.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="bluez-devel-5.55-150300.3.11.1">
      <FullProductName ProductID="bluez-devel-5.55-150300.3.11.1">bluez-devel-5.55-150300.3.11.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="bluez-devel-32bit-5.55-150300.3.11.1">
      <FullProductName ProductID="bluez-devel-32bit-5.55-150300.3.11.1">bluez-devel-32bit-5.55-150300.3.11.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="bluez-devel-64bit-5.55-150300.3.11.1">
      <FullProductName ProductID="bluez-devel-64bit-5.55-150300.3.11.1">bluez-devel-64bit-5.55-150300.3.11.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="bluez-test-5.55-150300.3.11.1">
      <FullProductName ProductID="bluez-test-5.55-150300.3.11.1">bluez-test-5.55-150300.3.11.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="libbluetooth3-5.55-150300.3.11.1">
      <FullProductName ProductID="libbluetooth3-5.55-150300.3.11.1">libbluetooth3-5.55-150300.3.11.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="libbluetooth3-32bit-5.55-150300.3.11.1">
      <FullProductName ProductID="libbluetooth3-32bit-5.55-150300.3.11.1">libbluetooth3-32bit-5.55-150300.3.11.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="libbluetooth3-64bit-5.55-150300.3.11.1">
      <FullProductName ProductID="libbluetooth3-64bit-5.55-150300.3.11.1">libbluetooth3-64bit-5.55-150300.3.11.1</FullProductName>
    </Branch>
    <Relationship ProductReference="bluez-5.55-150300.3.11.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Module for Basesystem 15 SP3">
      <FullProductName ProductID="SUSE Linux Enterprise Module for Basesystem 15 SP3:bluez-5.55-150300.3.11.1">bluez-5.55-150300.3.11.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP3</FullProductName>
    </Relationship>
    <Relationship ProductReference="bluez-deprecated-5.55-150300.3.11.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Module for Basesystem 15 SP3">
      <FullProductName ProductID="SUSE Linux Enterprise Module for Basesystem 15 SP3:bluez-deprecated-5.55-150300.3.11.1">bluez-deprecated-5.55-150300.3.11.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP3</FullProductName>
    </Relationship>
    <Relationship ProductReference="libbluetooth3-5.55-150300.3.11.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Module for Basesystem 15 SP3">
      <FullProductName ProductID="SUSE Linux Enterprise Module for Basesystem 15 SP3:libbluetooth3-5.55-150300.3.11.1">libbluetooth3-5.55-150300.3.11.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP3</FullProductName>
    </Relationship>
    <Relationship ProductReference="bluez-devel-5.55-150300.3.11.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Module for Desktop Applications 15 SP3">
      <FullProductName ProductID="SUSE Linux Enterprise Module for Desktop Applications 15 SP3:bluez-devel-5.55-150300.3.11.1">bluez-devel-5.55-150300.3.11.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP3</FullProductName>
    </Relationship>
    <Relationship ProductReference="bluez-cups-5.55-150300.3.11.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Workstation Extension 15 SP3">
      <FullProductName ProductID="SUSE Linux Enterprise Workstation Extension 15 SP3:bluez-cups-5.55-150300.3.11.1">bluez-cups-5.55-150300.3.11.1 as a component of SUSE Linux Enterprise Workstation Extension 15 SP3</FullProductName>
    </Relationship>
    <Relationship ProductReference="bluez-5.55-150300.3.11.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.3">
      <FullProductName ProductID="openSUSE Leap 15.3:bluez-5.55-150300.3.11.1">bluez-5.55-150300.3.11.1 as a component of openSUSE Leap 15.3</FullProductName>
    </Relationship>
    <Relationship ProductReference="bluez-auto-enable-devices-5.55-150300.3.11.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.3">
      <FullProductName ProductID="openSUSE Leap 15.3:bluez-auto-enable-devices-5.55-150300.3.11.1">bluez-auto-enable-devices-5.55-150300.3.11.1 as a component of openSUSE Leap 15.3</FullProductName>
    </Relationship>
    <Relationship ProductReference="bluez-cups-5.55-150300.3.11.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.3">
      <FullProductName ProductID="openSUSE Leap 15.3:bluez-cups-5.55-150300.3.11.1">bluez-cups-5.55-150300.3.11.1 as a component of openSUSE Leap 15.3</FullProductName>
    </Relationship>
    <Relationship ProductReference="bluez-deprecated-5.55-150300.3.11.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.3">
      <FullProductName ProductID="openSUSE Leap 15.3:bluez-deprecated-5.55-150300.3.11.1">bluez-deprecated-5.55-150300.3.11.1 as a component of openSUSE Leap 15.3</FullProductName>
    </Relationship>
    <Relationship ProductReference="bluez-devel-5.55-150300.3.11.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.3">
      <FullProductName ProductID="openSUSE Leap 15.3:bluez-devel-5.55-150300.3.11.1">bluez-devel-5.55-150300.3.11.1 as a component of openSUSE Leap 15.3</FullProductName>
    </Relationship>
    <Relationship ProductReference="bluez-devel-32bit-5.55-150300.3.11.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.3">
      <FullProductName ProductID="openSUSE Leap 15.3:bluez-devel-32bit-5.55-150300.3.11.1">bluez-devel-32bit-5.55-150300.3.11.1 as a component of openSUSE Leap 15.3</FullProductName>
    </Relationship>
    <Relationship ProductReference="bluez-test-5.55-150300.3.11.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.3">
      <FullProductName ProductID="openSUSE Leap 15.3:bluez-test-5.55-150300.3.11.1">bluez-test-5.55-150300.3.11.1 as a component of openSUSE Leap 15.3</FullProductName>
    </Relationship>
    <Relationship ProductReference="libbluetooth3-5.55-150300.3.11.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.3">
      <FullProductName ProductID="openSUSE Leap 15.3:libbluetooth3-5.55-150300.3.11.1">libbluetooth3-5.55-150300.3.11.1 as a component of openSUSE Leap 15.3</FullProductName>
    </Relationship>
    <Relationship ProductReference="libbluetooth3-32bit-5.55-150300.3.11.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.3">
      <FullProductName ProductID="openSUSE Leap 15.3:libbluetooth3-32bit-5.55-150300.3.11.1">libbluetooth3-32bit-5.55-150300.3.11.1 as a component of openSUSE Leap 15.3</FullProductName>
    </Relationship>
  </ProductTree>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="1">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">A heap overflow vulnerability was found in bluez in versions prior to 5.63. An attacker with local network access could pass specially crafted files causing an application to halt or crash, leading to a denial of service.</Note>
    </Notes>
    <CVE>CVE-2022-0204</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Linux Enterprise Module for Basesystem 15 SP3:bluez-5.55-150300.3.11.1</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Basesystem 15 SP3:bluez-deprecated-5.55-150300.3.11.1</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Basesystem 15 SP3:libbluetooth3-5.55-150300.3.11.1</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Desktop Applications 15 SP3:bluez-devel-5.55-150300.3.11.1</ProductID>
        <ProductID>SUSE Linux Enterprise Workstation Extension 15 SP3:bluez-cups-5.55-150300.3.11.1</ProductID>
        <ProductID>openSUSE Leap 15.3:bluez-5.55-150300.3.11.1</ProductID>
        <ProductID>openSUSE Leap 15.3:bluez-auto-enable-devices-5.55-150300.3.11.1</ProductID>
        <ProductID>openSUSE Leap 15.3:bluez-cups-5.55-150300.3.11.1</ProductID>
        <ProductID>openSUSE Leap 15.3:bluez-deprecated-5.55-150300.3.11.1</ProductID>
        <ProductID>openSUSE Leap 15.3:bluez-devel-32bit-5.55-150300.3.11.1</ProductID>
        <ProductID>openSUSE Leap 15.3:bluez-devel-5.55-150300.3.11.1</ProductID>
        <ProductID>openSUSE Leap 15.3:bluez-test-5.55-150300.3.11.1</ProductID>
        <ProductID>openSUSE Leap 15.3:libbluetooth3-32bit-5.55-150300.3.11.1</ProductID>
        <ProductID>openSUSE Leap 15.3:libbluetooth3-5.55-150300.3.11.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>important</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>5.8</BaseScoreV2>
        <VectorV2>AV:A/AC:L/Au:N/C:P/I:P/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>7.1</BaseScoreV3>
        <VectorV3>CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2022/suse-su-20222883-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2022-0204.html</URL>
        <Description>CVE-2022-0204</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1194704</URL>
        <Description>SUSE Bug 1194704</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
</cvrfdoc>
