CVE-2019-9970: Undefined Security Weakness

Open Whisper Signal aka Signal-Desktop through 1.23.1 and the Signal Private Messenger application through 4.35.3 for Android are vulnerable to an IDN homograph attack when displaying messages containing URLs. This occurs because the application produces a clickable link even if for example Latin...

PT-2019-19968

Name of the Vulnerable Software and Affected Versions Open Whisper Signal aka Signal-Desktop versions 1.23.1 and earlier Signal Private Messenger application versions 4.35.3 and earlier for Android Description The issue occurs when the application displays messages containing URLs, making it...

Open Whisper Signal Denial of Service Vulnerability

Signal is an encrypted instant messaging and voice calling software that supports iOS, Android, Debian-based distributions, macOS and Windows platforms. A denial of service vulnerability exists in Open Whisper Signal for iOS version 2.29.0 and earlier. The vulnerability stems from a failure of...

Design/Logic Flaw

The image rendering component createGenericPreview of the Open Whisper Signal app through 2.29.0 for iOS fails to check for unreasonably large images before manipulating received images. This allows for a large image sent to a user to exhaust all available memory when the image is displayed,...

CVE-2018-16132

The image rendering component createGenericPreview of the Open Whisper Signal app through 2.29.0 for iOS fails to check for unreasonably large images before manipulating received images. This allows for a large image sent to a user to exhaust all available memory when the image is displayed,...

CVE-2018-16132

The image rendering component createGenericPreview of the Open Whisper Signal app through 2.29.0 for iOS fails to check for unreasonably large images before manipulating received images. This allows for a large image sent to a user to exhaust all available memory when the image is displayed,...

CVE-2018-16132

The image rendering component createGenericPreview of the Open Whisper Signal app through 2.29.0 for iOS fails to check for unreasonably large images before manipulating received images. This allows for a large image sent to a user to exhaust all available memory when the image is displayed,...

CVE-2018-16132

The CVE describes an issue in the Open Whisper Signal app (iOS) up to version 2.29.0 where the image rendering component createGenericPreview does not validate excessively large inputs before processing them. This can allow a large image sent to a user to exhaust available memory when displayed, ...

PT-2018-13416

Name of the Vulnerable Software and Affected Versions Open Whisper Signal versions through 2.29.0 Description The issue arises from the image rendering component, specifically the createGenericPreview function, which fails to check for unreasonably large images before manipulating them. This allo...

CVE-2018-16132: Uncontrolled Resource Consumption

The image rendering component createGenericPreview of the Open Whisper Signal app through 2.29.0 for iOS fails to check for unreasonably large images before manipulating received images. This allows for a large image sent to a user to exhaust all available memory when the image is displayed,...

Open Whisper Signal Information Disclosure Vulnerability

Open Whisper Signal aka Signal-Desktop is a live chat application with encryption. An information disclosure vulnerability exists in versions prior to Open Whisper Signal 1.15.0-beta.10. An attacker can exploit the vulnerability to recover expired messages...

CVE-2018-14023

Open Whisper Signal aka Signal-Desktop before 1.15.0-beta.10 allows information leakage...

CVE-2018-14023

Open Whisper Signal aka Signal-Desktop before 1.15.0-beta.10 allows information leakage...

CVE-2018-14023

CVE-2018-14023 affects Open Whisper Signal (Signal-Desktop). Multiple sources describe an information-disclosure vulnerability that exists in versions prior to 1.15.0-beta.10, allowing an attacker to recover expired messages. The CNVD entry explicitly states “Open Whisper Signal Information Discl...

CVE-2018-14023

Open Whisper Signal aka Signal-Desktop before 1.15.0-beta.10 allows information leakage...

CVE-2018-14023: Exposure of Sensitive Information to an Unauthorized Actor

Open Whisper Signal aka Signal-Desktop before 1.15.0-beta.10 allows information leakage...

PT-2018-12283

Name of the Vulnerable Software and Affected Versions Open Whisper Signal aka Signal-Desktop versions prior to 1.15.0-beta.10 Description The issue allows information leakage. Recommendations For versions prior to 1.15.0-beta.10, update to version 1.15.0-beta.10 or later to resolve the issue...

Open Whisper Signal Cross-Site Scripting Vulnerability

Open Whisper Signal aka Signal-Desktop is a live chat application with encryption. A cross-site scripting vulnerability exists in Open Whisper Signal 1.10.1 and earlier versions, which stems from the program failing to filter HTML elements. A remote attacker can exploit the vulnerability by sendi...

CVE-2018-11101

Open Whisper Signal aka Signal-Desktop through 1.10.1 allows XSS via a resource location specified in an attribute of a SCRIPT, IFRAME, or IMG element, leading to JavaScript execution after a reply, a different vulnerability than CVE-2018-10994. The attacker needs to send HTML code directly as a...

Design/Logic Flaw

Open Whisper Signal aka Signal-Desktop through 1.10.1 allows XSS via a resource location specified in an attribute of a SCRIPT, IFRAME, or IMG element, leading to JavaScript execution after a reply, a different vulnerability than CVE-2018-10994. The attacker needs to send HTML code directly as a...