PT-2020-15161 · Facebook · Whatsapp Business For Ios+4

Published 2020-10-06 · Updated 2020-10-15 · CVE-2020-1907

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WhatsApp for Android versions prior to 2.20.196.16 WhatsApp Business for Android versions prior to 2.20.196.12 WhatsApp for iOS versions prior to 2.20.90 WhatsApp Business for iOS versions prior to 2.20.90 WhatsApp for Portal versions prior to 173.0.0.29.505

Description A stack overflow could have allowed arbitrary code execution when parsing the contents of an RTP Extension header.

Recommendations For WhatsApp for Android versions prior to 2.20.196.16, update to version 2.20.196.16 or later. For WhatsApp Business for Android versions prior to 2.20.196.12, update to version 2.20.196.12 or later. For WhatsApp for iOS versions prior to 2.20.90, update to version 2.20.90 or later. For WhatsApp Business for iOS versions prior to 2.20.90, update to version 2.20.90 or later. For WhatsApp for Portal versions prior to 173.0.0.29.505, update to version 173.0.0.29.505 or later.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2020-1907

Affected Products

Whatsapp Business For Android

Whatsapp Business For Ios

Whatsapp For Android

Whatsapp For Portal

Whatsapp For Ios

References · 3

• https://whatsapp.com/security/advisories/2020 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-1907 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-1907 · Security Note