CVE-2020-5753

Name of the Vulnerable Software and Affected Versions Signal Private Messenger Android versions 4.59.0 and up Signal Private Messenger iOS versions 3.8.1.5 and up

Description The issue allows a remote non-contact to ring a victim's Signal phone and disclose the currently used DNS server due to ICE Candidate handling before the call is answered or declined. This occurs because of improper handling of ICE candidates, which can lead to information disclosure about the victim's network setup.

Recommendations For Signal Private Messenger Android versions 4.59.0 and up, consider disabling call functionality until a patch is available. For Signal Private Messenger iOS versions 3.8.1.5 and up, restrict access to call features to minimize the risk of exploitation.