{"containers": {"cna": {"affected": [{"product": "WhatsApp for Android", "vendor": "Facebook", "versions": [{"status": "affected", "version": "2.20.196.16"}, {"lessThan": "2.20.196.16", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "WhatsApp Business for Android", "vendor": "Facebook", "versions": [{"status": "affected", "version": "2.20.196.12"}, {"lessThan": "2.20.196.12", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "WhatsApp for iOS", "vendor": "Facebook", "versions": [{"status": "affected", "version": "2.20.90"}, {"lessThan": "2.20.90", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "WhatsApp Business for iOS", "vendor": "Facebook", "versions": [{"status": "affected", "version": "2.20.90"}, {"lessThan": "2.20.90", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "WhatsApp for Portal", "vendor": "Facebook", "versions": [{"status": "affected", "version": "173.0.0.29.505"}, {"lessThan": "173.0.0.29.505", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "dateAssigned": "2020-10-06T00:00:00", "descriptions": [{"lang": "en", "value": "A stack overflow in WhatsApp for Android prior to v2.20.196.16, WhatsApp Business for Android prior to v2.20.196.12, WhatsApp for iOS prior to v2.20.90, WhatsApp Business for iOS prior to v2.20.90, and WhatsApp for Portal prior to v173.0.0.29.505 could have allowed arbitrary code execution when parsing the contents of an RTP Extension header."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-787", "description": "CWE-787: Out-of-bounds Write", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2020-10-06T17:35:27", "orgId": "4fc57720-52fe-4431-a0fb-3d2c8747b827", "shortName": "facebook"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://www.whatsapp.com/security/advisories/2020/"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve-assign@fb.com", "DATE_ASSIGNED": "2020-10-06", "ID": "CVE-2020-1907", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "WhatsApp for Android", "version": {"version_data": [{"version_affected": "!=>", "version_value": "2.20.196.16"}, {"version_affected": "<", "version_value": "2.20.196.16"}]}}, {"product_name": "WhatsApp Business for Android", "version": {"version_data": [{"version_affected": "!=>", "version_value": "2.20.196.12"}, {"version_affected": "<", "version_value": "2.20.196.12"}]}}, {"product_name": "WhatsApp for iOS", "version": {"version_data": [{"version_affected": "!=>", "version_value": "2.20.90"}, {"version_affected": "<", "version_value": "2.20.90"}]}}, {"product_name": "WhatsApp Business for iOS", "version": {"version_data": [{"version_affected": "!=>", "version_value": "2.20.90"}, {"version_affected": "<", "version_value": "2.20.90"}]}}, {"product_name": "WhatsApp for Portal", "version": {"version_data": [{"version_affected": "!=>", "version_value": "173.0.0.29.505"}, {"version_affected": "<", "version_value": "173.0.0.29.505"}]}}]}, "vendor_name": "Facebook"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "A stack overflow in WhatsApp for Android prior to v2.20.196.16, WhatsApp Business for Android prior to v2.20.196.12, WhatsApp for iOS prior to v2.20.90, WhatsApp Business for iOS prior to v2.20.90, and WhatsApp for Portal prior to v173.0.0.29.505 could have allowed arbitrary code execution when parsing the contents of an RTP Extension header."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-787: Out-of-bounds Write"}]}]}, "references": {"reference_data": [{"name": "https://www.whatsapp.com/security/advisories/2020/", "refsource": "CONFIRM", "url": "https://www.whatsapp.com/security/advisories/2020/"}]}}}}, "cveMetadata": {"assignerOrgId": "4fc57720-52fe-4431-a0fb-3d2c8747b827", "assignerShortName": "facebook", "cveId": "CVE-2020-1907", "datePublished": "2020-10-06T17:35:27", "dateReserved": "2019-12-02T00:00:00", "dateUpdated": "2020-10-06T17:35:27", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:whatsapp:whatsapp:*:*:*:*:*:iphone_os:*:*", "matchCriteriaId": "E27F4563-ACF1-44D8-BC87-477D935B8F99", "versionEndExcluding": "2.20.90", "vulnerable": true}, {"criteria": "cpe:2.3:a:whatsapp:whatsapp:*:*:*:*:*:android:*:*", "matchCriteriaId": "52C884A6-89FA-47EE-BC8E-C15BE7A6C125", "versionEndExcluding": "2.20.196.16", "vulnerable": true}, {"criteria": "cpe:2.3:a:whatsapp:whatsapp:*:*:*:*:*:portal:*:*", "matchCriteriaId": "E0CC3EA5-3726-4B82-8BD6-F49C3B1707E5", "versionEndExcluding": "173.0.0.29.505", "vulnerable": true}, {"criteria": "cpe:2.3:a:whatsapp:whatsapp_business:*:*:*:*:*:iphone_os:*:*", "matchCriteriaId": "ACB71228-9A27-43B1-A54A-98A6ED1316C1", "versionEndExcluding": "2.20.90", "vulnerable": true}, {"criteria": "cpe:2.3:a:whatsapp:whatsapp_business:*:*:*:*:*:android:*:*", "matchCriteriaId": "1D6120AE-331E-43D5-A8F3-0656AC0C2184", "versionEndExcluding": "2.20.196.12", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "A stack overflow in WhatsApp for Android prior to v2.20.196.16, WhatsApp Business for Android prior to v2.20.196.12, WhatsApp for iOS prior to v2.20.90, WhatsApp Business for iOS prior to v2.20.90, and WhatsApp for Portal prior to v173.0.0.29.505 could have allowed arbitrary code execution when parsing the contents of an RTP Extension header."}, {"lang": "es", "value": "Un desbordamiento de pila en WhatsApp para Android anterior a versi\u00f3n v2.20.196.16, WhatsApp Business para Android anterior a versi\u00f3n v2.20.196.12, WhatsApp para iOS anterior a versi\u00f3n v2.20.90, WhatsApp Business para iOS anterior a versi\u00f3n v2.20.90 y WhatsApp para Portal anterior a versi\u00f3n v173.0.0.29.505, podr\u00eda haber permitido una ejecuci\u00f3n de c\u00f3digo arbitrario cuando analiza el contenido de un encabezado RTP Extension"}], "id": "CVE-2020-1907", "lastModified": "2020-10-15T16:42:06.887", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-10-06T18:15:17.187", "references": [{"source": "cve-assign@fb.com", "tags": ["Vendor Advisory"], "url": "https://www.whatsapp.com/security/advisories/2020/"}], "sourceIdentifier": "cve-assign@fb.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-787"}], "source": "cve-assign@fb.com", "type": "Secondary"}]}

{}