Packages / Debian 12 (Bookworm) / Source / net / telegram-desktop

Source Package: telegram-desktop (4.6.5+ds-2+b1)

fast and secure messaging application

The following binary packages are built from this source package:

telegram-desktop
fast and secure messaging application

Known vulnerabilities

Matching against OpenFactory catalog package versions is in progress.

CVE	Severity	Version impact
[CVE-2026-107181] Published: Oct 7, 2026, 2:17:08 PM UTC Telegram Desktop before 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sandbox that allows remote attackers to inject OPEN: records via crafted tg:// links containing unescape	High(8.6)	Affected Details (2) `4.6.5+ds-2+b1` · amd64 · bookworm Affected nvd · telegram-desktop · debian · bookworm; nvd · telegram-desktop · debian · 12 `4.6.5+ds-2+b1` · arm64 · bookworm Affected nvd · telegram-desktop · debian · bookworm; nvd · telegram-desktop · debian · 12
[CVE-2026-94488] Published: Sep 21, 2026, 6:17:17 PM UTC Telegram Desktop before 6.9.4 allows XSS in the HTML exporter. (The first fixed stable version is 7.0.1.) This occurs in button.text.toUtf8 in export_output_html.cpp. Exploitation cannot occur unless	High(8.3)	Affected Details (2) `4.6.5+ds-2+b1` · amd64 · bookworm Affected nvd · telegram-desktop · debian · bookworm; nvd · telegram-desktop · debian · 12 `4.6.5+ds-2+b1` · arm64 · bookworm Affected nvd · telegram-desktop · debian · bookworm; nvd · telegram-desktop · debian · 12
[CVE-2026-7701] Published: May 3, 2026, 4:15:00 PM UTC A security vulnerability has been detected in Telegram Desktop up to 6.7.5. This vulnerability affects the function RequestButton of the file Telegram/SourceFiles/boxes/url_auth_box.cpp of the compone	Low(2.1)	Affected Details (2) `4.6.5+ds-2+b1` · amd64 · bookworm Affected nvd · telegram-desktop · debian · bookworm; nvd · telegram-desktop · debian · 12 `4.6.5+ds-2+b1` · arm64 · bookworm Affected nvd · telegram-desktop · debian · bookworm; nvd · telegram-desktop · debian · 12
[CVE-2021-47793] Published: Jan 16, 2026, 12:16:23 AM UTC telegram-desktop: CVE-2021-47793	Medium	Affected Details (2) `4.6.5+ds-2+b1` · amd64 · bookworm Affected dsa · telegram-desktop · debian · bookworm `4.6.5+ds-2+b1` · arm64 · bookworm Affected dsa · telegram-desktop · debian · bookworm
[CVE-2018-17613] Published: Sep 28, 2018, 10:29:00 AM UTC telegram-desktop: CVE-2018-17613	Low	Affected Details (2) `4.6.5+ds-2+b1` · amd64 · bookworm Affected dsa · telegram-desktop · debian · bookworm; dsa · telegram-desktop · debian · 12 `4.6.5+ds-2+b1` · arm64 · bookworm Affected dsa · telegram-desktop · debian · bookworm; dsa · telegram-desktop · debian · 12
[CVE-2018-17231] Published: Sep 19, 2018, 10:29:00 PM UTC telegram-desktop: CVE-2018-17231	Low	Affected Details (2) `4.6.5+ds-2+b1` · amd64 · bookworm Affected dsa · telegram-desktop · debian · bookworm; dsa · telegram-desktop · debian · 12 `4.6.5+ds-2+b1` · arm64 · bookworm Affected dsa · telegram-desktop · debian · bookworm; dsa · telegram-desktop · debian · 12

Fixed and unaffected versions (7)

CVE	Severity	Version impact
[CVE-2021-36769] Published: Jul 17, 2021, 12:15:00 AM UTC telegram-desktop: CVE-2021-36769	Medium	Fixed Details (2) `4.6.5+ds-2+b1` · amd64 · bookworm Fixed · Fixed: `2.9.2+ds-1` dsa · telegram-desktop · debian · bookworm; dsa · telegram-desktop · debian · 12 `4.6.5+ds-2+b1` · arm64 · bookworm Fixed · Fixed: `2.9.2+ds-1` dsa · telegram-desktop · debian · bookworm; dsa · telegram-desktop · debian · 12
[CVE-2021-27351] Published: Feb 19, 2021, 7:15:00 PM UTC telegram-desktop: CVE-2021-27351	Medium	Fixed Details (2) `4.6.5+ds-2+b1` · amd64 · bookworm Fixed · Fixed: `2.6.1-1` dsa · telegram-desktop · debian · bookworm; dsa · telegram-desktop · debian · 12 `4.6.5+ds-2+b1` · arm64 · bookworm Fixed · Fixed: `2.6.1-1` dsa · telegram-desktop · debian · bookworm; dsa · telegram-desktop · debian · 12
[CVE-2020-17448] Published: Aug 11, 2020, 5:15:00 PM UTC telegram-desktop: CVE-2020-17448	Medium	Fixed Details (2) `4.6.5+ds-2+b1` · amd64 · bookworm Fixed · Fixed: `2.2.0+ds-1` dsa · telegram-desktop · debian · bookworm; dsa · telegram-desktop · debian · 12 `4.6.5+ds-2+b1` · arm64 · bookworm Fixed · Fixed: `2.2.0+ds-1` dsa · telegram-desktop · debian · bookworm; dsa · telegram-desktop · debian · 12
[CVE-2020-12474] Published: May 1, 2020, 2:15:00 PM UTC telegram-desktop: CVE-2020-12474	Medium	Fixed Details (2) `4.6.5+ds-2+b1` · amd64 · bookworm Fixed · Fixed: `2.1.0+ds-1` dsa · telegram-desktop · debian · bookworm; dsa · telegram-desktop · debian · 12 `4.6.5+ds-2+b1` · arm64 · bookworm Fixed · Fixed: `2.1.0+ds-1` dsa · telegram-desktop · debian · bookworm; dsa · telegram-desktop · debian · 12
[CVE-2019-10044] Published: Mar 25, 2019, 8:29:00 PM UTC telegram-desktop: CVE-2019-10044	Medium	Fixed Details (2) `4.6.5+ds-2+b1` · amd64 · bookworm Fixed · Fixed: `1.8.4-1` dsa · telegram-desktop · debian · bookworm; dsa · telegram-desktop · debian · 12 `4.6.5+ds-2+b1` · arm64 · bookworm Fixed · Fixed: `1.8.4-1` dsa · telegram-desktop · debian · bookworm; dsa · telegram-desktop · debian · 12
[CVE-2018-17780] Published: Sep 29, 2018, 7:29:00 PM UTC telegram-desktop: CVE-2018-17780	Medium	Fixed Details (2) `4.6.5+ds-2+b1` · amd64 · bookworm Fixed · Fixed: `1.4.0-1` dsa · telegram-desktop · debian · bookworm; dsa · telegram-desktop · debian · 12 `4.6.5+ds-2+b1` · arm64 · bookworm Fixed · Fixed: `1.4.0-1` dsa · telegram-desktop · debian · bookworm; dsa · telegram-desktop · debian · 12
[CVE-2016-10351] Published: May 1, 2017, 1:59:00 AM UTC telegram-desktop: CVE-2016-10351	Medium	Fixed Details (2) `4.6.5+ds-2+b1` · amd64 · bookworm Fixed · Fixed: `1.1.19-2` dsa · telegram-desktop · debian · bookworm; dsa · telegram-desktop · debian · 12 `4.6.5+ds-2+b1` · arm64 · bookworm Fixed · Fixed: `1.1.19-2` dsa · telegram-desktop · debian · bookworm; dsa · telegram-desktop · debian · 12

Last synced: Oct 28, 2026, 12:44:10 AM UTC

[CVE catalog]

Sources

Debian 12 (Bookworm) main amd64Sep 1, 2026
Authoritative source; repository metadata signature verified
Signature evidence
bookworm-main-amd64:9e0b5aabb2465b3d2e7a7fe27f9913846277833f7a2826e7767acccff5b588c5
Repository-signature verification record
Signed object
https://deb.debian.org/debian/dists/bookworm/InRelease
Signed-object SHA-256
77737fa4b34f2693e982cc9ee35736816c35a7778fc2d326cc1bbf5b301fe1aa
Signer fingerprint
4CB50190207B4758A3F73A796ED0E7B82643E131
Keyring revision
debian-archive-keyring.gpg
SHA-256 506b815cbb32d9b6066b4a2aa524071e071761e7e7f68c3ac74f3061ba852017
Tool and policy
gpgv (GnuPG) 2.4.9
openfactory-software-catalog-signature-v1
Verification time
Sep 1, 2026
Repository metadata hash linkage
Path
main/binary-amd64/Packages.xz
Expected SHA-256
9e0b5aabb2465b3d2e7a7fe27f9913846277833f7a2826e7767acccff5b588c5
Observed SHA-256
9e0b5aabb2465b3d2e7a7fe27f9913846277833f7a2826e7767acccff5b588c5
Result
match verified
Debian 12 (Bookworm) main arm64Sep 1, 2026
Authoritative source; repository metadata signature verified
Signature evidence
bookworm-main-arm64:2ddb1737692e8c45c53e8d57c0ce4cd21c78c5703b830c3226b1423566a06c00
Repository-signature verification record
Signed object
https://deb.debian.org/debian/dists/bookworm/InRelease
Signed-object SHA-256
77737fa4b34f2693e982cc9ee35736816c35a7778fc2d326cc1bbf5b301fe1aa
Signer fingerprint
4CB50190207B4758A3F73A796ED0E7B82643E131
Keyring revision
debian-archive-keyring.gpg
SHA-256 506b815cbb32d9b6066b4a2aa524071e071761e7e7f68c3ac74f3061ba852017
Tool and policy
gpgv (GnuPG) 2.4.9
openfactory-software-catalog-signature-v1
Verification time
Sep 1, 2026
Repository metadata hash linkage
Path
main/binary-arm64/Packages.xz
Expected SHA-256
2ddb1737692e8c45c53e8d57c0ce4cd21c78c5703b830c3226b1423566a06c00
Observed SHA-256
2ddb1737692e8c45c53e8d57c0ce4cd21c78c5703b830c3226b1423566a06c00
Result
match verified