CVE-2020-27853

2020-10-2718:15:12

Google

osv.dev

8.3 High

AI Score

Confidence

High

0.01 Low

EPSS

Percentile

83.5%

JSON

Wire before 2020-10-16 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a format string. This affects Wire AVS (Audio, Video, and Signaling) 5.3 through 6.x before 6.4, the Wire Secure Messenger application before 3.49.918 for Android, and the Wire Secure Messenger application before 3.61 for iOS. This occurs via the value parameter to sdp_media_set_lattr in peerflow/sdp.c.

CPENameOperatorVersion
wire-desktopeqrelease/2.11.2705
wire-desktopeqrelease/3.3.2872
wire-desktopeqrelease/2.11.2687
wire-desktopeqrelease/2.13.2741
wire-desktopeqmacos/3.10.3215
wire-desktopeqrelease/2.12.2728
wire-desktopeqrelease/2.13.2731
wire-desktopeqlinux/3.9.2895
wire-desktopeqwindows/3.10.3138
wire-desktopeqrelease/3.0.2816

Name	Operator	Version
wire-desktop	eq	release/2.11.2705
wire-desktop	eq	release/3.3.2872
wire-desktop	eq	release/2.11.2687
wire-desktop	eq	release/2.13.2741
wire-desktop	eq	macos/3.10.3215
wire-desktop	eq	release/2.12.2728
wire-desktop	eq	release/2.13.2731
wire-desktop	eq	linux/3.9.2895
wire-desktop	eq	windows/3.10.3138
wire-desktop	eq	release/3.0.2816