Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability

Life Of This Page

1. 1
   Born
   Nov 10 12:00 UTC
   A second, independent source names it.
2. 2
   Developing
   Nov 10 12:00 UTC
   New signals join; severity can move.
3. 3
   Confirmed · Now
   Nov 10 12:00 UTC
   CISA KEV lists it, or exploitation in the wild is reported.
4. 4
   Resolved
   Not yet
   Past the fix deadline and 14 days with no new signal.
5. 5
   Archived
   Not yet
   30 days after resolved. Read only; the link keeps working. Reopens if it comes back.

The ID never changes, and earlier addresses keep working. A correction is logged, never overwritten. If two pages turn out to be one incident, the later one points to the earlier.

Vulnerability Lifecycle

1. Disclosed: reached
   Oct 16 19:17 UTC
   C6 NVD published
2. Scored: reached
   Oct 16 19:17 UTC
   CVSS 4.3 · EPSS 0.3%
3. Exploited: reached
   Nov 10 12:00 UTC
   C1 CISA KEV, fix by Nov 24
4. Advisories: reached
   Nov 10 12:00 UTC
   1 government and CERT sources
5. Vendor Response: not yet
   Not yet
   None in sources yet
6. Resolved: not yet
   Not yet
   When fixed: KEV deadline Nov 24, then 14 quiet days

Timeline

Point at a mark to read it. Squares are signals, colored by severity; every one is also listed under Signals.