CVE-2019-17192

CRITICAL

9.8

CVSS Severity Score

EPSS Score0.1400%

EPSS Percentile8.85th

PublishedOct 5, 2019

Last ModifiedNov 21, 2024

Vulnerability Description

The WebRTC component in the Signal Private Messenger application through 4.47.7 for Android processes videoconferencing RTP packets before a callee chooses to answer a call, which might make it easier for remote attackers to cause a denial of service or possibly have unspecified other impact via malformed packets. NOTE: the vendor plans to continue this behavior for performance reasons unless a WebRTC design change occurs

Affected Platforms (CPE)

📦

Signal

Private Messenger

<= 4.47.7

References & Advisories

🔗 https://bugs.chromium.org/p/project-zero/issues/detail?id=1936

🔗 https://news.ycombinator.com/item?id=21161432

🔗 https://twitter.com/moxie/status/1180226374851710976