CVE-2020-5753

MEDIUM

5.3

CVSS Severity Score

EPSS Score0.1780%

EPSS Percentile17.89th

PublishedMay 20, 2020

Last ModifiedNov 21, 2024

Vulnerability Description

Signal Private Messenger Android v4.59.0 and up and iOS v3.8.1.5 and up allows a remote non-contact to ring a victim's Signal phone and disclose currently used DNS server due to ICE Candidate handling before call is answered or declined.

Affected Platforms (CPE)

📦

Signal

Private Messenger

<= 4.59.0

📦

Signal

<= 3.8.1.5

References & Advisories

🔗 https://www.tenable.com/security/research/tra-2020-33

Related Vulnerabilities

CVE-2019-171929.8

The WebRTC component in the Signal Private Messenger application through 4.47.7 for Android processes videoconferencing RTP packet...

CVE-2019-171917.5

The Signal Private Messenger application before 4.47.7 for Android allows a caller to force a call to be answered, without callee ...

CVE-2019-99706.5

Open Whisper Signal (aka Signal-Desktop) through 1.23.1 and the Signal Private Messenger application through 4.35.3 for Android ar...

CVE-2018-39884.7

Signal Messenger for Android 4.24.8 may expose private information when using "disappearing messages." If a user uses the photo fe...