#VU35829 Buffer overflow in WhatsApp Messenger for Android - CVE-2018-6339
Published: June 14, 2019 / Updated: August 8, 2020
Vulnerability identifier: #VU35829
Vulnerability risk: High
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
CVE-ID: CVE-2018-6339
CWE-ID: CWE-119
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
WhatsApp Messenger for Android
WhatsApp Messenger for Android
Software vendor:
WhatsApp
Description
The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
When receiving calls using WhatsApp on Android, a stack allocation failed to properly account for the amount of data being passed in. An off-by-one error meant that data was written beyond the allocated space on the stack. This issue affects WhatsApp for Android starting in version 2.18.180 and was fixed in version 2.18.295. It also affects WhatsApp Business for Android starting in version v2.18.103 and was fixed in version v2.18.150.
Remediation
Install update from vendor's website.