PT-2022-9434 · Facebook · Whatsapp For Ios+4

Published 2022-01-04 · Updated 2022-01-14 · CVE-2021-24042

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WhatsApp for Android versions prior to 2.21.23 WhatsApp Business for Android versions prior to 2.21.23 WhatsApp for iOS versions prior to 2.21.230 WhatsApp Business for iOS versions prior to 2.21.230 WhatsApp for KaiOS versions prior to 2.2143 WhatsApp Desktop versions prior to 2.2146

Description The issue could have allowed an out-of-bounds write if a user makes a 1:1 call to a malicious actor.

Recommendations For WhatsApp for Android versions prior to 2.21.23, update to version 2.21.23 or later. For WhatsApp Business for Android versions prior to 2.21.23, update to version 2.21.23 or later. For WhatsApp for iOS versions prior to 2.21.230, update to version 2.21.230 or later. For WhatsApp Business for iOS versions prior to 2.21.230, update to version 2.21.230 or later. For WhatsApp for KaiOS versions prior to 2.2143, update to version 2.2143 or later. For WhatsApp Desktop versions prior to 2.2146, update to version 2.2146 or later.

Fix

Memory Corruption

Heap Based Buffer Overflow

Weakness Enumeration

CWE-787

CWE-122

Related Identifiers

CVE-2021-24042

Affected Products

Whatsapp Business For Android

Whatsapp Business For Ios

Whatsapp Desktop

Whatsapp For Android

Whatsapp For Ios

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2021-24042 · Security Note
• https://whatsapp.com/security/advisories/2021 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-24042 · Vendor Advisory
• https://t.me/cibsecurity/34959 · Telegram Post