CyberSec.Space Logo
Back to CVE Browser

CVE-2019-17191

HIGH
7.5
CVSS Severity Score
EPSS Score0.0620%
EPSS Percentile7.49th
PublishedOct 5, 2019
Last ModifiedNov 21, 2024

Vulnerability Description

The Signal Private Messenger application before 4.47.7 for Android allows a caller to force a call to be answered, without callee user interaction, via a connect message. The existence of the call is noticeable to the callee; however, the audio channel may be open before the callee can block eavesdropping.

Affected Platforms (CPE)

📦
Signal

Private Messenger

< 4.47.7

References & Advisories

🔗 https://bugs.chromium.org/p/project-zero/issues/detail?id=1943
🔗 https://news.ycombinator.com/item?id=21161432
🔗 https://twitter.com/moxie/status/1180261210341511168
🔗 https://bugs.chromium.org/p/project-zero/issues/detail?id=1943
🔗 https://news.ycombinator.com/item?id=21161432
🔗 https://twitter.com/moxie/status/1180261210341511168

Related Vulnerabilities

CVE-2019-171929.8

The WebRTC component in the Signal Private Messenger application through 4.47.7 for Android processes videoconferencing RTP packet...

CVE-2019-99706.5

Open Whisper Signal (aka Signal-Desktop) through 1.23.1 and the Signal Private Messenger application through 4.35.3 for Android ar...

CVE-2020-57535.3

Signal Private Messenger Android v4.59.0 and up and iOS v3.8.1.5 and up allows a remote non-contact to ring a victim's Signal phon...

CVE-2018-39884.7

Signal Messenger for Android 4.24.8 may expose private information when using "disappearing messages." If a user uses the photo fe...