Paper/Archive/CVE-2020-1909

CVE-2020-1909

Facebook WhatsApp Business for iOS — A use-after-free in a logging library in WhatsApp for iOS prior to v2.20.111 and WhatsApp Business for iOS prior to v2.20.111 could have…

EPSS 2%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 83.2.832 × 2016.6 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

A use-after-free in a logging library in WhatsApp for iOS prior to v2.20.111 and WhatsApp Business for iOS prior to v2.20.111 could have resulted in memory corruption, crashes and potentially code execution. This could have happened only if several events occurred together in sequence, including receiving an animated sticker while placing a WhatsApp video call on hold.

Affected

ProductAffectedFixed inSource

WhatsApp Business for iOS2.20.111–CNA

WhatsApp Business for iOSunspecified – < 2.20.1112.20.111CNA

WhatsApp Business for iOS2.20.81 – < unspecifiedunspecifiedCNA

WhatsApp for iOS2.20.111–CNA

WhatsApp for iOSunspecified – < 2.20.1112.20.111CNA

WhatsApp for iOS2.20.81 – < unspecifiedunspecifiedCNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refwhatsapp.com/security/advisories/2020