by Kastro
Paper/Archive/CVE-2020-1907

CVE-2020-1907

Facebook WhatsApp for Android — A stack overflow in WhatsApp for Android prior to v2.20.196.16, WhatsApp Business for Android prior to v2.20.196.12, WhatsApp for iOS pri…

EPSS 2%CVSS 9.8
critical.is priorityof 100
45
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 79.5.795 × 2015.9No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

A stack overflow in WhatsApp for Android prior to v2.20.196.16, WhatsApp Business for Android prior to v2.20.196.12, WhatsApp for iOS prior to v2.20.90, WhatsApp Business for iOS prior to v2.20.90, and WhatsApp for Portal prior to v173.0.0.29.505 could have allowed arbitrary code execution when parsing the contents of an RTP Extension header.

Affected

ProductAffectedFixed inSource
WhatsApp for Android2.20.196.16–CNA
WhatsApp for Androidunspecified – < 2.20.196.162.20.196.16CNA
WhatsApp Business for Android2.20.196.12–CNA
WhatsApp Business for Androidunspecified – < 2.20.196.122.20.196.12CNA
WhatsApp for iOS2.20.90–CNA
WhatsApp for iOSunspecified – < 2.20.902.20.90CNA
WhatsApp Business for iOS2.20.90–CNA
WhatsApp Business for iOSunspecified – < 2.20.902.20.90CNA
WhatsApp for Portal173.0.0.29.505–CNA
WhatsApp for Portalunspecified – < 173.0.0.29.505173.0.0.29.505CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refwhatsapp.com/security/advisories/2020