CVE-2020-27853
First published: Tue Oct 27 2020(Updated: )
Wire before 2020-10-16 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a format string. This affects Wire AVS (Audio, Video, and Signaling) 5.3 through 6.x before 6.4, the Wire Secure Messenger application before 3.49.918 for Android, and the Wire Secure Messenger application before 3.61 for iOS. This occurs via the value parameter to sdp_media_set_lattr in peerflow/sdp.c.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Wire Wire | <3.21.2936 | |
| Wire Wire | <3.21.3932 | |
| Wire Wire | <3.21.3959 | |
| Wire Wire - Audio\, Video\, And Signaling | >=5.3<6.4 | |
| Wire Wire Secure Messenger | <3.49.918 | |
| Wire Wire Secure Messenger | <3.61 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2020-27853?
CVE-2020-27853 is a vulnerability that allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a format string.
Which software versions are affected by CVE-2020-27853?
Wire AVS (Audio, Video, and Signaling) versions 5.3 through 6.x before 6.4, Wire Secure Messenger application before 3.49.918 for Android, and Wire Secure Messenger application before 3.61 for iPhone OS are affected.
What is the severity of CVE-2020-27853?
CVE-2020-27853 has a severity rating of 9.8 (critical).
How can CVE-2020-27853 be exploited?
CVE-2020-27853 can be exploited by remote attackers through a format string vulnerability.
Are there any references for CVE-2020-27853?
Yes, you can find references for CVE-2020-27853 at the following links: - [http://github.security.telekom.com/2020/11/wire-secure-messenger-format-string-vulnerability.html](http://github.security.telekom.com/2020/11/wire-secure-messenger-format-string-vulnerability.html) - [https://github.com/wireapp/wire-audio-video-signaling/issues/23#issuecomment-710075689](https://github.com/wireapp/wire-audio-video-signaling/issues/23#issuecomment-710075689)
- collector/nvd-index
- agent/references
- agent/weakness
- agent/severity
- agent/author
- agent/type
- agent/description
- agent/tags
- agent/event
- vendor/wire
- canonical/wire wire
- canonical/wire wire - audio\, video\, and signaling
- version/wire wire - audio\, video\, and signaling/5.3
- canonical/wire wire secure messenger