Buffer overflow in Facebook Whatsapp Business For Android
CVE-2019-11931
A stack-based buffer overflow could be triggered in WhatsApp by sending a specially crafted MP4 file to a WhatsApp user. The issue was present in parsing the elementary stream metadata of an MP4 file and could result in a DoS or RCE. This affects Android versions prior to 2.19.274, iOS versions prior to 2.19.100, Enterprise Client versions prior to 2.25.3, Business for Android versions prior to 2.19.104 and Business for iOS versions prior to 2.19.100.
Vulnerability class: Buffer Overflow
EPSS: 0.012 (66.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
Affected products
- Facebook Whatsapp Business For Android — versions 2.19.104, unspecified
- Facebook Whatsapp Business For Ios — versions 2.19.100, unspecified
- Facebook Whatsapp Enterprise Client — versions 2.25.3, unspecified
- Facebook Whatsapp For Android — versions 2.19.274, unspecified
- Facebook Whatsapp For Ios — versions 2.19.100, unspecified
- Facebook Whatsapp For Windows Phone — versions unspecified
- Whatsapp Whatsapp_business
- Whatsapp Whatsapp_enterprise_client
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve-assign@fb.com (x_refsource_CONFIRM, Third Party Advisory)
Frequently asked questions
- What is CVE-2019-11931?
- CVE-2019-11931 is a high-severity vulnerability in Facebook Whatsapp Business For Android, classified under Stack-based Buffer Overflow. CVSS score: 7.8/10. Published 2019-11-14.
- How severe is CVE-2019-11931?
- High severity. CVSS v3 base score is 7.8 out of 10.
- Is CVE-2019-11931 known to be exploited?
- 6 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.