Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2017-14586: Hipchat for Mac can run malicious code from video link
CVE-2017-14586 · published 8 years ago
Summary
The Hipchat desktop app for Mac versions 4.0 up to but not including 4.30 can be tricked into executing unwanted programs when it processes a specially crafted video call link. This could allow an attacker to take control of the user’s computer without their knowledge. Update the application to version 4.30 or later, or remove the software if it is no longer needed.
What to do
- Update atlassian hipchat to version 4.30 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| atlassian | hipchat |
>= 4.0, < 4.30 cpe:2.3:a:atlassian:hipchat:*:*:*:*:*:macos:*:* |
Original advisory text
The Hipchat for Mac desktop client is vulnerable to client-side remote code execution via video call link parsing. Hipchat for Mac desktop clients at or above version 4.0 and before version 4.30 ar...
The Hipchat for Mac desktop client is vulnerable to client-side remote code execution via video call link parsing. Hipchat for Mac desktop clients at or above version 4.0 and before version 4.30 are affected by this vulnerability.
References
- http://www.securityfocus.com/bid/101947 Third Party Advisory VDB Entry
- https://confluence.atlassian.com/hc/hipchat-server-security-advisory-2017-11-22-... Vendor Advisory
- https://jira.atlassian.com/browse/HCPUB-3473 Issue Tracking Vendor Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Type
CWE-119Buffer Overflow
Timeline
Published27 Nov 2017
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2017-14586 · NVD
Track software like this
Free during beta