Signal Client v6.2 and earlier versions vulnerable to CVE-2023–24068 & CVE-2023–24069

After I read the PoC from John Jackson, I had to try. I ran into my computer and checked the version of the Signal Client that I had installed. The version is 6.2.0, which is allegedly vulnerable. So I started reading about how I can explode the CVE-2023–24068. And this brings us to CVE-2023–24069:

Signal Desktop before 6.2.0 on Windows, Linux, and macOS allow an attacker to obtain potentially sensitive attachments sent in messages from the attachments.noindex directory. The cached …

client cve cybersecurity security-vulnerabilities signal vulnerable