PT-2018-13416 · Signal · Open Whisper Signal

Nick M. Mckenna · Publicado 2018-08-29 · Atualizado 2018-11-08 · CVE-2018-16132

Positive Technologies (AI Summary)

CVSS v3.1

8.6

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Open Whisper Signal versions through 2.29.0

Description The issue arises from the image rendering component, specifically the createGenericPreview function, which fails to check for unreasonably large images before manipulating them. This allows an attacker to send a large image to a user, causing the device to exhaust its available memory when the image is displayed, resulting in a forced restart.

Recommendations For versions through 2.29.0, as a temporary workaround, consider disabling the image preview feature until a patch is available. Restrict the receipt of large images to minimize the risk of exploitation.

Correção

Resource Exhaustion

Enumeração de Fraquezas

CWE-400

Identificadores relacionados

CVE-2018-16132

Produtos afetados

Open Whisper Signal

Referências · 3

• https://osv.dev/vulnerability/CVE-2018-16132 · Aviso do Fabricante
• http://seclists.org/bugtraq/2018/Aug/57 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-16132 · Nota de Segurança