critical9.8
CVE-2021-41193
Use of Externally-Controlled Format String in wire-avs
Impact
### Impact A remote format string vulnerability allowed an attacker to cause a denial of service or possibly execute arbitrary code. ### Patches * The issue has been fixed in wire-avs 7.1.12 and is already included on all Wire products (currently used version is 8.0.x) ### Workarounds * No workaround known ### References * Fixed in commit https://github.com/wireapp/wire-avs/commit/40d373ede795443ae6f2f756e9fb1f4f4ae90bbe ### For more information If you have any questions or comments about this advisory feel free to email us at [vulnerability-report@wire.com](mailto:vulnerability-report@wire.com)
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | com.wire:avs | < 7.1.12 | 7.1.12 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Wire | Wire-Audio Video Signaling | before 7.1.12 |