by Kastro
Paper/Archive/CVE-2020-1891

CVE-2020-1891

Facebook WhatsApp Android — A user controlled parameter used in video call in WhatsApp for Android prior to v2.20.17, WhatsApp Business for Android prior to v2.20.7,…

EPSS 1%CVSS 9.8
critical.is priorityof 100
44
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 74.1.741 × 2014.8No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

A user controlled parameter used in video call in WhatsApp for Android prior to v2.20.17, WhatsApp Business for Android prior to v2.20.7, WhatsApp for iPhone prior to v2.20.20, and WhatsApp Business for iPhone prior to v2.20.20 could have allowed an out-of-bounds write on 32-bit devices.

Affected

ProductAffectedFixed inSource
WhatsApp Android2.20.17–CNA
WhatsApp Androidunspecified – < 2.20.172.20.17CNA
WhatsApp Business for Android2.20.7–CNA
WhatsApp Business for Androidunspecified – < 2.20.72.20.7CNA
WhatsApp iPhone2.20.20–CNA
WhatsApp iPhoneunspecified – < 2.20.202.20.20CNA
WhatsApp Business for iPhone2.20.20–CNA
WhatsApp Business for iPhoneunspecified – < 2.20.202.20.20CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refwhatsapp.com/security/advisories/2020