PT-2019-6106 · Facebook · Whatsapp Business+1

Published 2019-12-02 · Updated 2021-09-03 · CVE-2020-1910

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions WhatsApp versions prior to v2.21.1.13 WhatsApp Business versions prior to v2.21.1.13

Description The issue is related to a missing bounds check in the applyFilterIntoBuffer() function, which can lead to out-of-bounds read and write. This can occur when a user applies specific image filters to a specially crafted image and sends the resulting image. The vulnerability can allow a remote attacker to cause a denial of service or access sensitive information from the WhatsApp memory.

Recommendations For WhatsApp versions prior to v2.21.1.13, update to version v2.21.1.13 or later. For WhatsApp Business versions prior to v2.21.1.13, update to version v2.21.1.13 or later. As a temporary workaround, consider avoiding the use of specific image filters in WhatsApp until the issue is resolved.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

BDU:2021-05614

CVE-2020-1910

Affected Products

Whatsapp

Whatsapp Business

References · 8

• https://whatsapp.com/security/advisories/2021 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-1910 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-05614 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-1910 · Security Note
• https://t.me/thebugbountyhunter/5635 · Telegram Post
• https://t.me/cibsecurity/22964 · Telegram Post
• https://t.me/true_secator/2069 · Telegram Post
• https://t.me/ckure/9167 · Telegram Post