Friday, March 29, 2024

WhatsApp Discloses 6 Bugs That Allows Attackers to Execute Code Remotely

WhatsApp disclosed 6 security bugs through their dedicated security advisory site that allows attackers to execute remote code.

WhatsApp is a messaging app used by more than two billion users around the world. All the vulnerabilities are disclosed in dedicated security advisory site aimed to provide more transparent details about vulnerabilities for users and security professionals.

“We take the security of our users very seriously and we provide industry-leading protection for our users around the world. Our security team at WhatsApp works with experts around the world to stay ahead of potential threats,” reads the blog post.

6 Security WhatsApp Bugs

  1. CVE-2020-1894 – A stack write overflow Bug in WhatsApp Business for Android
  2. CVE-2020-1891 -A user controlled parameter used in video call in WhatsApp for Android
  3. CVE-2020-1890 – A URL validation issue in WhatsApp for Android
  4. CVE-2020-1889 – security feature bypass issue in WhatsApp Desktop versions
  5. CVE-2020-1886 – A buffer overflow in WhatsApp for Android
  6. CVE-2019-11928 -An input validation issue in WhatsApp Desktop versions

CVE-2020-1894

A stack write overflow which allows attackers to execute arbitrary code when playing a specially crafted push to talk message.

It affects WhatsApp for Android before v2.20.35, WhatsApp Business for Android before v2.20.20, WhatsApp for iPhone before v2.20.30, and WhatsApp Business for iPhone before v2.20.30.

CVE-2020-1891

A user-controlled parameter used in a video call in WhatsApp allowed an out-of-bounds write on 32-bit devices.

The bug affects WhatsApp for Android before v2.20.17, WhatsApp Business for Android before v2.20.7, WhatsApp for iPhone before v2.20.20, and WhatsApp Business for iPhone before v2.20.20.

CVE-2020-1890

A URL validation issue in WhatsApp for Android before v2.20.11 and WhatsApp Business for Android before v2.20.2 would allow the execution of malformed data in a sticker message that loads images from URL controlled by the sender.

CVE-2020-1889

A security feature bypass issue in WhatsApp Desktop versions before v0.3.4932 could have allowed for sandbox escape in Electron and escalation of privilege if combined with a remote code execution vulnerability inside the sandboxed renderer process.

CVE-2020-1886

A buffer overflow in WhatsApp for Android before v2.20.11 and WhatsApp Business for Android before v2.20.2 could have allowed an out-of-bounds write via a specially crafted video stream after receiving and answering a malicious video call.

CVE-2019-11928

An input validation issue in WhatsApp Desktop versions before v0.3.4932 could have allowed cross-site scripting upon clicking on a link from a specially crafted live location message.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity updates

Also Read:

WhatsApp Bug Leaked Personal Phone Numbers in Google Search Results

Critical WhatsApp Vulnerability Let Hackers to Access the Local System Files on Mac & Windows

Website

Latest articles

How to Analyse .NET Malware? – Reverse Engineering Snake Keylogger

Utilizing sandbox analysis for behavioral, network, and process examination provides a foundation for reverse...

GoPlus’s Latest Report Highlights How Blockchain Communities Are Leveraging Critical API Security Data To Mitigate Web3 Threats

GoPlus Labs, the leading Web3 security infrastructure provider, has unveiled a groundbreaking report highlighting...

Wireshark 4.2.4 Released: What’s New!

Wireshark stands as the undisputed leader, offering unparalleled tools for troubleshooting, analysis, development, and...

Zoom Unveils AI-Powered All-In-One AI Work Workplace

Zoom has taken a monumental leap forward by introducing Zoom Workplace, an all-encompassing AI-powered...

iPhone Users Beware! Darcula Phishing Service Attacking Via iMessage

Phishing allows hackers to exploit human vulnerabilities and trick users into revealing sensitive information...

2 Chrome Zero-Days Exploited at Pwn2Own 2024: Patch Now

Google has announced a crucial update to its Chrome browser, addressing several vulnerabilities, including...
Guru baran
Guru baranhttps://gbhackers.com
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles