CVE-2020-27853 Other in n/a
Remote attackers can cause application crashes or execute arbitrary code via a format string vulnerability in the Wire Secure Messenger application.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-27853?
CVE-2020-27853 is a critical vulnerability in n/a, published on 27 Oct 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Wire before 2020-10-16 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a format string. This affects Wire AVS (Audio, Video, and Signaling) 5.3 through 6.x before 6.4, the Wire Secure Messenger application before 3.49.918 for Android, and the Wire Secure Messenger application before 3.61 for iOS. This occurs via the value parameter to sdp_media_set_lattr in peerflow/sdp.c.
Weakness: CWE-134
Which versions are affected by CVE-2020-27853?
It affects 3 products.
Products include Wire Wire, Wire Wire - Audio\, Video\, and Signaling, Wire Wire Secure Messenger.
How do I fix CVE-2020-27853?
No fix has been published for CVE-2020-27853 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-27853 being exploited?
There is no known exploitation of CVE-2020-27853 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2021-32665 Verified groups not reliable
- CVE-2020-15258 Insecure use of shell.openExternal in Wire
- CVE-2018-8909 Path traversal in n/a
- CVE-2021-41093 Account takeover when having only access to a user's short lived token
- CVE-2023-22737 wire-server vulnerable to unauthorized removal of Bots from Conversations
Sources
Also known as GHSA-72jw-4jcq-xh9j.