CVE-2023-24068
First published: Mon Jan 23 2023(Updated: )
** DISPUTED ** Signal Desktop before 6.2.0 on Windows, Linux, and macOS allows an attacker to modify conversation attachments within the attachments.noindex directory. Client mechanisms fail to validate modifications of existing cached files, resulting in an attacker's ability to insert malicious code into pre-existing attachments or replace them completely. A threat actor can forward the existing attachment in the corresponding conversation to external groups, and the name and size of the file will not change, allowing the malware to masquerade as another file. NOTE: the vendor disputes the relevance of this finding because the product is not intended to protect against adversaries with this degree of local access.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Signal Signal-desktop | <=6.2.0 | |
| Apple macOS | ||
| Linux Linux kernel | ||
| Microsoft Windows | ||
| All of | ||
| Signal Signal-desktop | <=6.2.0 | |
| Any of | ||
| Apple macOS | ||
| Linux Linux kernel | ||
| Microsoft Windows |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID of Signal Desktop?
The vulnerability ID of Signal Desktop is CVE-2023-24068.
What is the severity of CVE-2023-24068?
The severity of CVE-2023-24068 is high with a severity value of 7.8.
Which operating systems are affected by CVE-2023-24068?
Signal Desktop before version 6.2.0 is affected on Windows, Linux, and macOS.
What is the risk of CVE-2023-24068?
CVE-2023-24068 allows an attacker to modify conversation attachments within the attachments.noindex directory, potentially allowing them to insert malicious content.
How can I fix CVE-2023-24068?
To fix CVE-2023-24068, update Signal Desktop to version 6.2.0 or later.
- collector/nvd-index
- agent/type
- agent/references
- agent/first-publish-date
- agent/author
- agent/severity
- agent/status
- agent/description
- agent/event
- agent/softwarecombine
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- collector/mitre-cve
- source/MITRE
- status/disputed
- vendor/signal
- canonical/signal signal-desktop
- version/signal signal-desktop/6.2.0
- vendor/apple
- canonical/apple macos
- vendor/linux
- canonical/linux linux kernel
- vendor/microsoft
- canonical/microsoft windows