GCVE - cpe:2.3:a:signal:private_messenger:*:*:*:*:*:android:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:signal:private_messenger:*:*:*:*:*:android:*:*

part: a version: * update: *

Vendor	Signal (`1528301b-b5f4-5810-a6e3-05f776be2194`)
Product	Private Messenger (`fef94dd9-c8aa-5811-afb3-45580c2610ab`)
Edition	*
Language	*
Software edition	*
Target software	android
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2020-5753`	vulnerable	2026-06-08 05:26:43.667499	Details available Signal Private Messenger Android v4.59.0 and up and iOS v3.8.1.5 and up allows a remote non-contact to ring a victim's Signal phone and disclose currently used DNS server due to ICE Candidate handling before call is answered or declined. Published: 2020-05-20T13:40:19.000Z Updated: 2024-08-04T08:39:25.691Z Open on db.gcve.eu Reference links https://www.tenable.com/security/research/tra-2020-33	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-9970`	vulnerable	2026-06-08 05:14:26.734881	Details available Open Whisper Signal (aka Signal-Desktop) through 1.23.1 and the Signal Private Messenger application through 4.35.3 for Android are vulnerable to an IDN homograph attack when displaying messages containing URLs. This occurs because the application produces a clickable link even if (for example) Latin and Cyrillic characters exist in the same domain name, and the available font has an identical representation of characters from different alphabets. Published: 2019-03-24T01:52:33.000Z Updated: 2024-08-04T22:10:08.403Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/107550 https://github.com/blazeinfosec/advisories/blob/master/signal-advisory.txt	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-17192`	vulnerable	2026-06-08 05:13:10.091690	Details available The WebRTC component in the Signal Private Messenger application through 4.47.7 for Android processes videoconferencing RTP packets before a callee chooses to answer a call, which might make it easier for remote attackers to cause a denial of service or possibly have unspecified other impact via malformed packets. NOTE: the vendor plans to continue this behavior for performance reasons unless a WebRTC design change occurs Published: 2019-10-05T01:13:31.000Z Updated: 2024-08-05T01:33:17.261Z Open on db.gcve.eu Reference links https://news.ycombinator.com/item?id=21161432 https://twitter.com/moxie/status/1180226374851710976 https://bugs.chromium.org/p/project-zero/issues/detail?id=1936	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-17191`	vulnerable	2026-06-08 05:13:10.091267	Details available The Signal Private Messenger application before 4.47.7 for Android allows a caller to force a call to be answered, without callee user interaction, via a connect message. The existence of the call is noticeable to the callee; however, the audio channel may be open before the callee can block eavesdropping. Published: 2019-10-05T01:15:51.000Z Updated: 2024-08-05T01:33:17.289Z Open on db.gcve.eu Reference links https://news.ycombinator.com/item?id=21161432 https://twitter.com/moxie/status/1180261210341511168 https://bugs.chromium.org/p/project-zero/issues/detail?id=1943	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.