Use of Externally-Controlled Format String in wire-avs

NGHIÊM TRỌNG 9.8CVE-2021-41193 · GHSA-2j6v-xpf3-xvrv · Công bố 01/03/2022 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2021-41193 là lỗ hổng mức NGHIÊM TRỌNG (CVSS 9.8) ảnh hưởng com.wire:avs, wire-audio video signaling (wire).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 2.5%, cao hơn 84.5% các lỗ hổng khác.
Cách xử lý: cập nhật lên 7.1.12 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
com.wire:avs Maven	`< 7.1.12`	`7.1.12`
wire-audio video signaling wire	`< 7.1.12`	`7.1.12`

Mô tả

Impact

A remote format string vulnerability allowed an attacker to cause a denial of service or possibly execute arbitrary code.

Patches

The issue has been fixed in wire-avs 7.1.12 and is already included on all Wire products (currently used version is 8.0.x)

Workarounds

No workaround known

References

Fixed in commit https://github.com/wireapp/wire-avs/commit/40d373ede795443ae6f2f756e9fb1f4f4ae90bbe

For more information

If you have any questions or comments about this advisory feel free to email us at [email protected]

Mô tả của NVD

wire-avs is the audio visual signaling (AVS) component of Wire, an open-source messenger. A remote format string vulnerability in versions prior to 7.1.12 allows an attacker to cause a denial of service or possibly execute arbitrary code. The issue has been fixed in wire-avs 7.1.12. There are currently no known workarounds.