Vulnerabilities > Signal > Private Messenger
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2020-05-20 | CVE-2020-5753 | Always-Incorrect Control Flow Implementation vulnerability in Signal Signal Private Messenger Android v4.59.0 and up and iOS v3.8.1.5 and up allows a remote non-contact to ring a victim's Signal phone and disclose currently used DNS server due to ICE Candidate handling before call is answered or declined. | 5.3 |
| 2019-10-05 | CVE-2019-17192 | Always-Incorrect Control Flow Implementation vulnerability in Signal Private Messenger The WebRTC component in the Signal Private Messenger application through 4.47.7 for Android processes videoconferencing RTP packets before a callee chooses to answer a call, which might make it easier for remote attackers to cause a denial of service or possibly have unspecified other impact via malformed packets. | 9.8 |
| 2019-10-05 | CVE-2019-17191 | Incorrect Authorization vulnerability in Signal Private Messenger The Signal Private Messenger application before 4.47.7 for Android allows a caller to force a call to be answered, without callee user interaction, via a connect message. | 7.5 |
| 2019-03-24 | CVE-2019-9970 | Unspecified vulnerability in Signal Signal-Desktop Open Whisper Signal (aka Signal-Desktop) through 1.23.1 and the Signal Private Messenger application through 4.35.3 for Android are vulnerable to an IDN homograph attack when displaying messages containing URLs. | 6.5 |
| 2018-12-10 | CVE-2018-3988 | Information Exposure vulnerability in Signal Private Messenger 4.24.8 Signal Messenger for Android 4.24.8 may expose private information when using "disappearing messages." If a user uses the photo feature available in the "attach file" menu, then Signal will leave the picture in its own cache directory, which is available to any application on the system. | 4.7 |