Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Heap Buffer Overflow in the LottieParserImpl::parseDashProperty function of their custom fork of the rlottie library. A remote attacker might be able to access heap memory out-of-bounds on a victim device via a malicious animated sticker.
References
| Link | Resource |
|---|---|
| https://www.shielder.it/advisories/telegram-rlottie-lottieparserimpl-parsedashproperty-heap-buffer-overflow/ | Exploit Third Party Advisory |
| https://www.shielder.it/blog/2021/02/hunting-for-bugs-in-telegrams-animated-stickers-remote-attack-surface/ | Exploit Third Party Advisory |
| https://www.shielder.it/advisories/telegram-rlottie-lottieparserimpl-parsedashproperty-heap-buffer-overflow/ | Exploit Third Party Advisory |
| https://www.shielder.it/blog/2021/02/hunting-for-bugs-in-telegrams-animated-stickers-remote-attack-surface/ | Exploit Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 06:05
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://www.shielder.it/advisories/telegram-rlottie-lottieparserimpl-parsedashproperty-heap-buffer-overflow/ - Exploit, Third Party Advisory | |
| References | () https://www.shielder.it/blog/2021/02/hunting-for-bugs-in-telegrams-animated-stickers-remote-attack-surface/ - Exploit, Third Party Advisory |
Information
Published : 2021-05-18 20:15
Updated : 2024-11-21 06:05
NVD link : CVE-2021-31323
Mitre link : CVE-2021-31323
CVE.ORG link : CVE-2021-31323
JSON object : View
Products Affected
telegram
- telegram
CWE
CWE-787
Out-of-bounds Write