CVE-2022-39212: Last video frame is still sent after video is disabled in a call in Nextcloud Talk
Nextcloud Talk is an open source chat, video & audio calls client for the Nextcloud platform. In affected versions an attacker could see the last video frame of any participant who has video disabled but a camera selected. It is recommended that the Nextcloud Talk app is upgraded to 13.0.8 or 14.0.4. Users unable to upgrade should select "None" as camera before joining the call.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2022-39212?
CVE-2022-39212 is a vulnerability in the Nextcloud Talk app that allows an attacker to see the last video frame of any participant who has video disabled but a camera selected.
How does CVE-2022-39212 impact Nextcloud Talk?
CVE-2022-39212 allows an attacker to view the last video frame of participants who have video disabled but a camera selected.
How severe is CVE-2022-39212?
CVE-2022-39212 has a severity rating of 5.3 (Medium).
What software versions are affected by CVE-2022-39212?
Versions up to 13.0.8 and versions between 14.0.0 and 14.0.4 of the Nextcloud Talk app are affected.
How can I mitigate the CVE-2022-39212 vulnerability?
To mitigate the CVE-2022-39212 vulnerability, it is recommended to upgrade the Nextcloud Talk app to version 13.0.8 or 14.0.4.