Last video frame is still sent after video is disabled in a call

Moderate

nickvergessen published GHSA-wq3g-2x46-q2gv

Sep 16, 2022

Package

Talk (Nextcloud)

Affected versions

< 13.0.8, < 14.0.4

Patched versions

13.0.8, 14.0.4

Description

Impact

An attacker could see the last video frame of any participant who has video disabled but a camera selected.

Patches

It is recommended that the Nextcloud Talk app is upgraded to 13.0.8 or 14.0.4.

Workarounds

Select "None" as camera before joining the call.

References

For more information

If you have any questions or comments about this advisory:

Create a post in nextcloud/security-advisories
Customers: Open a support ticket at support.nextcloud.com

Severity

Moderate

4.3

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

Low

User interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N