Summary
It was discovered that the Mumble client supported websites for public servers
with arbitrary URL schemes. If a user were tricked into visiting a malicious
website from the public server list, a remote attacker could possibly execute
arbitrary code.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 18.04 LTS 18.04:LTS | mumble | 1.2.19-1ubuntu1.1 |
| Ubuntu · 20.04 LTS 20.04:LTS | mumble | 1.3.0+dfsg-1ubuntu0.1 |
Vulnerabilities 1
-
Unscored —
Mumble before 1.3.4 allows remote code execution if a victim navigates to a crafted URL on a server list and clicks on …
References
-
report
https://ubuntu.com/security/CVE-2021-27229