PT-2019-6106 · Facebook · Whatsapp Business+1

Publicado 2019-12-02 · Atualizado 2021-09-03 · CVE-2020-1910

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions WhatsApp versions prior to v2.21.1.13 WhatsApp Business versions prior to v2.21.1.13

Description The issue is related to a missing bounds check in the applyFilterIntoBuffer() function, which can lead to out-of-bounds read and write. This can occur when a user applies specific image filters to a specially crafted image and sends the resulting image. The vulnerability can allow a remote attacker to cause a denial of service or access sensitive information from the WhatsApp memory.

Recommendations For WhatsApp versions prior to v2.21.1.13, update to version v2.21.1.13 or later. For WhatsApp Business versions prior to v2.21.1.13, update to version v2.21.1.13 or later. As a temporary workaround, consider avoiding the use of specific image filters in WhatsApp until the issue is resolved.

Correção

Memory Corruption

Enumeração de Fraquezas

CWE-787

Identificadores relacionados

BDU:2021-05614

CVE-2020-1910

Produtos afetados

Whatsapp

Whatsapp Business

Referências · 8

• https://t.me/thebugbountyhunter/5635 · Publicação no Telegram
• https://t.me/cibsecurity/22964 · Publicação no Telegram
• https://t.me/true_secator/2069 · Publicação no Telegram
• https://whatsapp.com/security/advisories/2021 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2020-1910 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2021-05614 · Nota de Segurança
• https://t.me/ckure/9167 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2020-1910 · Nota de Segurança