JVN#43561812: +Message App improper handling of Unicode control characters

+Message App displays text unprocessed, even when control characters are contained, and the text is shown based on Unicode control character’s specifications.
Therefore, a crafted text may display misleading web links (CWE-451).

Impact

A spoofed URL may be displayed and phishing attacks may be conducted.

Solution

Update the Application
Update to the latest version according to the information provided by the developer.

Products Affected

SoftBank Corp.

• +Message App for Android prior to version 12.9.5

• +Message App for iOS prior to version 3.9.4
  NTT DOCOMO, INC.

• +Message App for Android prior to version 54.49.0500

• +Message App for iOS prior to version 3.9.4
  KDDI CORPORATION

• +Message App for Android prior to version 3.9.2

• +Message App for iOS prior to version 3.9.4