*Changes - Removed Android and iOS from the “Affected Products” section Users can help keep themselves secure by applying current updates or downloading the latest Zoom software with all current security updates from. This could result in an attacker gaining access to a user's device and data, and remote code execution. If a victim saves a local recording to an SMB location and later opens it using a link from Zoom’s web portal, an attacker positioned on an adjacent network to the victim client could set up a malicious SMB server to respond to client requests, causing the client to execute attacker controlled executables. Source: Reported by Zoom Offensive Security Team.ĬVSS Vector String: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:Hĭescription: Zoom clients prior to 5.13.5 contain an improper trust boundary implementation vulnerability. Zoom Video SDK for Linux version 1.8.0 only.Zoom Video SDK for iOS version 1.8.0 only.Zoom Video SDK for Android version 1.8.0 only.Zoom Video SDK for macOS version 1.8.0 only.Zoom Video SDK for Windows version 1.8.0 only.Zoom Meeting SDK for Windows version 5.15.1 only.Zoom Meeting SDK for macOS version 5.15.0 only.Zoom Meeting SDK for iOS version 5.15.0 only.Zoom Meeting SDK for Android version 5.15.0 only.Zoom Phone Appliance version 5.15.0 only.Zoom Rooms for iPad version 5.15.0 only.Zoom Rooms for macOS version 5.15.0 only.Zoom Rooms for Windows version 5.15.0 only.Zoom Mobile App for Android version 5.15.0 only.

Zoom Mobile App for iOS version 5.15.0 only.

Zoom Desktop Client for Linux version 5.15.0 only.

Zoom Desktop Client for macOS version 5.15.0 only.

Zoom Desktop Client for Windows 5.15.0 and 5.15.1.

Users can help keep themselves secure by applying current updates or downloading the latest Zoom software with all current security updates from, and avoid using the in-meeting chat while on the affected versions. In the affected products, a copy of each in-meeting chat message was also sent encrypted only using TLS and not with the per-meeting key, including messages sent during End-to-End Encrypted (E2EE) meetings. Zoom encrypts in-meeting chat messages using a per-meeting key and then transmits these encrypted messages between user devices and Zoom using TLS encryption.

CVSS Vector String: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:Nĭescription: Exposure of information intended to be encrypted by some Zoom clients may lead to disclosure of sensitive information.

Download zoom desktop client for mac