The vulnerability of the sdp_media_set_lattr() function in the Wire Secure Messenger application, related to the use of uncontrolled format strings, allows a hacker to execute arbitrary code or cause a service failure.

🗓️ 29 Jul 2022 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 2 Views

Uncontrolled format strings in sdp_media_set_lattr() allow code execution or service failure in Wire Secure Messenger.

Reporter	Title	Published	Views	Family All 8
IBM Security Bulletins	Security Bulletin: IBM Security Verify Information Queue uses a Wire Schema jar with multiple vulnerabilities (CVE-2020-27853, CVE-2021-41093)	20 Jul 202219:31	–	ibm
AlpineLinux	CVE-2020-27853	27 Oct 202018:15	–	alpinelinux
CVE	CVE-2020-27853	27 Oct 202017:53	–	cve
Cvelist	CVE-2020-27853	27 Oct 202017:53	–	cvelist
EUVD	EUVD-2020-20346	7 Oct 202500:30	–	euvd
NVD	CVE-2020-27853	27 Oct 202018:15	–	nvd
Prion	Format string	27 Oct 202018:15	–	prion
RedhatCVE	CVE-2020-27853	22 May 202517:33	–	redhatcve

Vulners

Node

wire_swiss_gmbh wire_secure_messengerRange<3.49.918

OR

wire_swiss_gmbh wire_-_audio,_video,_and_signaling_(avs)Range5.3–6.4

OR

wire_swiss_gmbh wire_secure_messengerMatch3.61

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2020-27853
vuldb	www.vuldb.com/
github	www.github.security.telekom.com/2020/11/wire-secure-messenger-format-string-vulnerability.html
github	www.github.com/wireapp/wire-audio-video-signaling/issues/23
web	www.web.nvd.nist.gov/view/vuln/detail

13 Sep 2024 00:00Current

8.2High risk

Vulners AI Score8.2

CVSS 39.8

CVSS 210

EPSS0.03224

sdp_media_set_lattr uncontrolled format strings wire secure messenger code execution service failure