CVE-2021-31317
First published: Tue May 18 2021(Updated: )
Last updated 24 July 2024
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Telegram Telegram | <7.1.0 | |
| Telegram Telegram | <7.1.0 | |
| Telegram Telegram | <7.1.0 | |
| debian/rlottie | 0.1+dfsg-2 0.1+dfsg-4 0.1+dfsg-4.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.shielder.it/advisories/telegram-rlottie-vdasher-vdasher-type-confusion/
- https://www.shielder.it/blog/2021/02/hunting-for-bugs-in-telegrams-animated-stickers-remote-attack-surface/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31317
- https://nvd.nist.gov/vuln/detail/CVE-2021-31317
- https://launchpad.net/bugs/cve/CVE-2021-31317
- https://security-tracker.debian.org/tracker/CVE-2021-31317
- https://ubuntu.com/security/CVE-2021-31317
Frequently Asked Questions
What is the vulnerability ID for this Telegram issue?
The vulnerability ID for this Telegram issue is CVE-2021-31317.
What is the affected software?
The affected software includes Telegram Android versions before 7.1.0 (2090), Telegram iOS versions before 7.1, and Telegram macOS versions before 7.1.
What is the severity level of CVE-2021-31317?
The severity level of CVE-2021-31317 is medium with a severity value of 5.5.
What is the vulnerability description?
Telegram Android, iOS, and macOS versions before 7.1 are affected by a Type Confusion vulnerability in the VDasher constructor of their custom fork of the rlottie library.
How can a remote attacker exploit this vulnerability?
A remote attacker might be able to access Telegram's heap memory out-of-bounds on a victim device via a malicious animation.
- collector/nvd-index
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/severity
- agent/first-publish-date
- collector/usn-cve
- source/Ubuntu
- agent/references
- agent/description
- collector/security-tracker-debian
- source/Debian
- agent/software-canonical-lookup
- agent/softwarecombine
- collector/launchpad-cve
- source/Launchpad
- agent/event
- collector/nvd-cve
- source/NVD
- agent/author
- agent/tags
- agent/last-modified-date
- agent/source
- vendor/telegram
- canonical/telegram telegram
- package-manager/debian