Whatsapp Business vulnerabilities

CVE-2019-11931 [HIGH] CWE-121 CVE-2019-11931: A stack-based buffer overflow could be triggered in WhatsApp by sending a specially crafted MP4 file A stack-based buffer overflow could be triggered in WhatsApp by sending a specially crafted MP4 file to a WhatsApp user. The issue was present in parsing the elementary stream metadata of an MP4 file and could result in a DoS or RCE. This affects Android versions prior to 2.19.274, iOS versions prior to 2.19.100, Enterprise Client versions prior to 2.

CVE-2018-6349 [CRITICAL] CWE-121 CVE-2018-6349: When receiving calls using WhatsApp for Android, a missing size check when parsing a sender-provided When receiving calls using WhatsApp for Android, a missing size check when parsing a sender-provided packet allowed for a stack-based overflow. This issue affects WhatsApp for Android prior to 2.18.248 and WhatsApp Business for Android prior to 2.18.132.

CVE-2018-6350 [CRITICAL] CWE-125 CVE-2018-6350: An out-of-bounds read was possible in WhatsApp due to incorrect parsing of RTP extension headers. Th An out-of-bounds read was possible in WhatsApp due to incorrect parsing of RTP extension headers. This issue affects WhatsApp for Android prior to 2.18.276, WhatsApp Business for Android prior to 2.18.99, WhatsApp for iOS prior to 2.18.100.6, WhatsApp Business for iOS prior to 2.18.100.2, and WhatsApp for Windows Phone prior to 2.18.224.

CVE-2018-20655 [CRITICAL] CWE-121 CVE-2018-20655: When receiving calls using WhatsApp for iOS, a missing size check when parsing a sender-provided pac When receiving calls using WhatsApp for iOS, a missing size check when parsing a sender-provided packet allowed for a stack-based overflow. This issue affects WhatsApp for iOS prior to v2.18.90.24 and WhatsApp Business for iOS prior to v2.18.90.24.

CVE-2018-6339 [CRITICAL] CWE-121 CVE-2018-6339: When receiving calls using WhatsApp on Android, a stack allocation failed to properly account for th When receiving calls using WhatsApp on Android, a stack allocation failed to properly account for the amount of data being passed in. An off-by-one error meant that data was written beyond the allocated space on the stack. This issue affects WhatsApp for Android starting in version 2.18.180 and was fixed in version 2.18.295. It also affects WhatsApp

CVE-2019-3568 [CRITICAL] CWE-122 CVE-2019-3568: A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially c A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RTCP packets sent to a target phone number. The issue affects WhatsApp for Android prior to v2.19.134, WhatsApp Business for Android prior to v2.19.44, WhatsApp for iOS prior to v2.19.51, WhatsApp Business for iOS prior to v2.19.51, W

CVE-2019-3566 [MEDIUM] CWE-284 CVE-2019-3566: A bug in WhatsApp for Android's messaging logic would potentially allow a malicious individual who h A bug in WhatsApp for Android's messaging logic would potentially allow a malicious individual who has taken over over a WhatsApp user's account to recover previously sent messages. This behavior requires independent knowledge of metadata for previous messages, which are not available publicly. This issue affects WhatsApp for Android 2.19.52 and 2.19.