CVE catalog

CVE-2019-10044

telegram-desktop: CVE-2019-10044

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
3.28% · Oct 25, 2026

Telegram Desktop before 1.5.12 on Windows, and the Telegram applications for Android, iOS, and Linux, is vulnerable to an IDN homograph attack when displaying messages containing URLs. This occurs because the application produces a clickable link even if (for example) Latin and Cyrillic characters exist in the same domain name, and the available font has an identical representation of characters from different alphabets.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiantelegram-desktopsid5.7.2+ds-5fixed
Debiantelegram-desktopforky5.7.2+ds-5fixed
Debiantelegram-desktopbookworm4.6.5+ds-2fixed
Ubuntutelegram-desktop18.041.1.23-1vulnerable
Ubuntutelegram-desktop18.041.1.23-1build1vulnerable
Ubuntutelegram-desktop18.041.1.23-2vulnerable
Ubuntutelegram-desktop18.041.1.23-3vulnerable
Ubuntutelegram-desktop18.041.2.6-1vulnerable
Ubuntutelegram-desktop18.041.2.6-2vulnerable
Ubuntutelegram-desktop18.041.2.6-2build1vulnerable
Ubuntutelegram-desktop18.041.2.6-2build2vulnerable
Ubuntutelegram-desktop18.041.2.6-2build3vulnerable
Ubuntutelegram-desktop18.041.2.15-1vulnerable
Ubuntutelegram-desktop18.041.2.15-1build1vulnerable
Ubuntutelegram-desktop18.041.2.17-1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiantelegram-desktopsourcesid1.8.4-1not yet assignedNot reported[927711]
Debiantelegram-desktopsourceforky1.8.4-1not yet assignedNot reported[927711]
Debiantelegram-desktopsourcebookworm1.8.4-1not yet assignedNot reported[927711]

[Debian bug #927711]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [telegram-desktop]Fixed

    Source package: [telegram-desktop]

    Details (2)

    • 4.6.5+ds-2+b1 · amd64 · bookworm

      Fixed · Fixed: 1.8.4-1

      dsa · telegram-desktop · debian · bookworm; dsa · telegram-desktop · debian · 12

    • 4.6.5+ds-2+b1 · arm64 · bookworm

      Fixed · Fixed: 1.8.4-1

      dsa · telegram-desktop · debian · bookworm; dsa · telegram-desktop · debian · 12

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]