Vulnerabilities

TI-2020-04681 CVE-2020-5753 · GHSA-cqgm-mqmr-px3p

Signal Private Messenger Android v4.59.0 and up and iOS v3.8.1.5 and up allows a remote…

LOW 26

Signal Private Messenger Android v4.59.0 and up and iOS v3.8.1.5 and up allows a remote non-contact to ring a victim's Signal phone and disclose currently used DNS server due to ICE Candidate handling before call is answ…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01102 Published 2020-05-20 No fix listed CWE-670

TI-2019-12816 CVE-2019-17191 · GHSA-hpqc-h2q8-cmcj

The Signal Private Messenger application before 4.47.7 for Android allows a caller to…

LOW 36

The Signal Private Messenger application before 4.47.7 for Android allows a caller to force a call to be answered, without callee user interaction, via a connect message.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01755 Published 2019-10-05 No fix listed CWE-863

TI-2019-12817 CVE-2019-17192 · GHSA-228q-pr2f-pghm

The WebRTC component in the Signal Private Messenger application through 4.47.7 for…

MEDIUM 47

The WebRTC component in the Signal Private Messenger application through 4.47.7 for Android processes videoconferencing RTP packets before a callee chooses to answer a call, which might make it easier for remote attacker…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02728 Published 2019-10-05 No fix listed CWE-670

TI-2019-07336 CVE-2019-9970 · GHSA-9p53-vpmw-2w5c

Open Whisper Signal (aka Signal-Desktop) through 1.23.1 and the Signal Private Messenger…

LOW 33

Open Whisper Signal (aka Signal-Desktop) through 1.23.1 and the Signal Private Messenger application through 4.35.3 for Android are vulnerable to an IDN homograph attack when displaying messages containing URLs.

CVSS 3.0MEDIUM 6.5 Network No auth User interaction EPSS 0.01834 Published 2019-03-24 No fix listed

TI-2018-02956 CVE-2018-3988 · GHSA-f287-vf22-3v2c

Information disclosure in Signal

LOW 22

Signal Messenger for Android 4.24.8 may expose private information when using "disappearing messages." If a user uses the photo feature available in the "attach file" menu, then Signal will leave the picture in its own c…

CVSS 3.1MEDIUM 4.7 Local Low privileges No interaction EPSS 0.00527 Published 2018-12-10 No fix listed CWE-200