by Kastro
Paper/Archive/CVE-2019-3568

CVE-2019-3568

Facebook WhatsApp for Android — WhatsApp VOIP Stack Buffer Overflow Vulnerability

KEV · due 10 MayEPSS 30%public exploitSSVC actCVSS 9.8
critical.is priorityof 100
99
CVSS 9.8 (ADP)9.8 / 10 × 3029.4In CISA KEV+3030.0EPSS percentile 98.2.982 × 2019.6Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RTCP packets sent to a target phone number. The issue affects WhatsApp for Android prior to v2.19.134, WhatsApp Business for Android prior to v2.19.44, WhatsApp for iOS prior to v2.19.51, WhatsApp Business for iOS prior to v2.19.51, WhatsApp for Windows Phone prior to v2.18.348, and WhatsApp for Tizen prior to v2.18.15.

Affected

ProductAffectedFixed inSource
WhatsApp for Android2.19.134–CNA
WhatsApp for Androidunspecified – < 2.19.1342.19.134CNA
WhatsApp Business for Android2.19.44–CNA
WhatsApp Business for Androidunspecified – < 2.19.1342.19.134CNA
WhatsApp for iOS2.19.51–CNA
WhatsApp for iOSunspecified – < 2.19.512.19.51CNA
WhatsApp Business for iOS2.19.51–CNA
WhatsApp Business for iOSunspecified – < 2.19.512.19.51CNA
WhatsApp for Windows Phone2.18.348–CNA
WhatsApp for Windows Phoneunspecified – < 2.18.3482.18.348CNA
WhatsApp for Tizen2.18.15–CNA
WhatsApp for Tizenunspecified – < 2.18.152.18.15CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

reffacebook.com/security/advisories/cve-2019-3568refsecurityfocus.com/bid/108329refcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-3568kevcisa.gov/known-exploited-vulnerabilities-catalog