CVEvulnerability
CVE-2020-27853
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2020-10-27
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-134
Description
Wire before 2020-10-16 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a format string. This affects Wire AVS (Audio, Video, and Signaling) 5.3 through 6.x before 6.4, the Wire Secure Messenger application before 3.49.918 for Android, and the Wire Secure Messenger application before 3.61 for iOS. This occurs via the value parameter to sdp_media_set_lattr in peerflow/sdp.c.
Affected configurations
• wire wire (< 3.21.2936)
• wire wire (< 3.21.3932)
• wire wire (< 3.21.3959)
• wire wire - audio\, video\, and signaling (>= 5.3 < 6.4)
• wire wire secure messenger (< 3.49.918)
• wire wire secure messenger (< 3.61)
Related
Weakness · CWE (1)
- CWE-134 Use of Externally-Controlled Format String weakness
References
- http://github.security.telekom.com/2020/11/wire-secure-messenger-format-string-vulnerability.html Exploit, Third Party Advisory
- https://github.com/wireapp/wire-audio-video-signaling/issues/23#issuecomment-710075689 Exploit, Third Party Advisory
- http://github.security.telekom.com/2020/11/wire-secure-messenger-format-string-vulnerability.html Exploit, Third Party Advisory
- https://github.com/wireapp/wire-audio-video-signaling/issues/23#issuecomment-710075689 Exploit, Third Party Advisory