Vulnerability identifier: #VU31041
Vulnerability risk: High
CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID:
CWE-ID:
CWE-119
Exploitation vector: Network
Exploit availability: No
Vulnerable software:
WhatsApp Messenger for Android
Mobile applications /
Apps for mobile phones
Vendor: WhatsApp
Description
The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
When receiving calls using WhatsApp for Android, a missing size check when parsing a sender-provided packet allowed for a stack-based overflow. This issue affects WhatsApp for Android prior to 2.18.248 and WhatsApp Business for Android prior to 2.18.132.
Mitigation
Install update from vendor's website.
Vulnerable software versions
WhatsApp Messenger for Android: 2.18.1 - 2.18.129
External links
http://www.securityfocus.com/bid/108804
http://www.facebook.com/security/advisories/cve-2018-6349/
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.