PT-2020-6437 · Telegram+2 · Telegram Android+4

Polict · Published 2020-09-21 · Updated 2025-01-10 · CVE-2021-31321

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Telegram Android versions 7.0 through 7.0 (2090) Telegram iOS versions prior to 7.1 Telegram macOS versions prior to 7.1

Description The issue is related to a buffer overflow in the gray split cubic function of the custom Rlottie library used for Lottie animation playback. This could allow a remote attacker to compromise data integrity and cause a denial of service by sending a malicious animated sticker. The exploitation of this issue may lead to out-of-bounds memory overwrite on a victim's device.

Recommendations For Telegram Android versions 7.0 through 7.0 (2090), update to version 7.1.0 (2090) or later. For Telegram iOS versions prior to 7.1, update to version 7.1 or later. For Telegram macOS versions prior to 7.1, update to version 7.1 or later. As a temporary workaround, consider restricting the use of animated stickers until a patch is available.

Exploit

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

BDU:2021-04689

CVE-2021-31321

USN-7198-1

Affected Products

Linuxmint

Telegram Android

Telegram Ios

Telegram Macos

Ubuntu

References · 18

• 🔥 https://shielder.it/advisories/telegram-rlottie-gray_split_cubic-stack-buffer-overflow · Exploit
• 🔥 https://shielder.it/blog/2021/02/hunting-for-bugs-in-telegrams-animated-stickers-remote-attack-surface · Exploit
• https://osv.dev/vulnerability/CVE-2021-31321 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-31318 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-31315 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-31317 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-31321 · Security Note
• https://ubuntu.com/security/CVE-2021-31321 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-31322 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7198-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-31320 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-31321 · Security Note
• https://bdu.fstec.ru/vul/2021-04689 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2021-31321 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7198-1 · Vendor Advisory