github - ghsa-6c69-f792-7pq7

GHSA-6C69-F792-7PQ7

Vulnerability from github – Published: 2022-05-24 17:01 – Updated: 2022-05-24 17:01

Details

A stack-based buffer overflow could be triggered in WhatsApp by sending a specially crafted MP4 file to a WhatsApp user. The issue was present in parsing the elementary stream metadata of an MP4 file and could result in a DoS or RCE. This affects Android versions prior to 2.19.274, iOS versions prior to 2.19.100, Enterprise Client versions prior to 2.25.3, Business for Android versions prior to 2.19.104 and Business for iOS versions prior to 2.19.100.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2019-11931"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-11-14T23:15:00Z",
    "severity": "MODERATE"
  },
  "details": "A stack-based buffer overflow could be triggered in WhatsApp by sending a specially crafted MP4 file to a WhatsApp user. The issue was present in parsing the elementary stream metadata of an MP4 file and could result in a DoS or RCE. This affects Android versions prior to 2.19.274, iOS versions prior to 2.19.100, Enterprise Client versions prior to 2.25.3, Business for Android versions prior to 2.19.104 and Business for iOS versions prior to 2.19.100.",
  "id": "GHSA-6c69-f792-7pq7",
  "modified": "2022-05-24T17:01:22Z",
  "published": "2022-05-24T17:01:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11931"
    },
    {
      "type": "WEB",
      "url": "https://www.facebook.com/security/advisories/cve-2019-11931"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

CVE-2019-11931 (GCVE-0-2019-11931)

Vulnerability from cvelistv5 – Published: 2019-11-14 22:55 – Updated: 2024-08-04 23:10

Summary

Severity ?

No CVSS data available.

CWE

CWE-121 - Stack-based Buffer Overflow (CWE-121)

Assigner

facebook

References

URL

Tags

https://www.facebook.com/security/advisories/cve-…

x_refsource_CONFIRM

Impacted products

Vendor

Product

Version

Facebook

WhatsApp for Android

Affected: 2.19.274
Affected: unspecified , < 2.19.274 (custom)

Facebook	WhatsApp for iOS	Affected: 2.19.100 Affected: unspecified , < 2.19.100 (custom)
Facebook	WhatsApp for Windows Phone	Affected: unspecified , ≤ 2.18.368 (custom)
Facebook	WhatsApp Enterprise Client	Affected: 2.25.3 Affected: unspecified , < 2.25.3 (custom)
Facebook	WhatsApp Business for Android	Affected: 2.19.104 Affected: unspecified , < 2.19.104 (custom)
Facebook	WhatsApp Business for iOS	Affected: 2.19.100 Affected: unspecified , < 2.19.100 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T23:10:29.691Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.facebook.com/security/advisories/cve-2019-11931"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "WhatsApp for Android",
          "vendor": "Facebook",
          "versions": [
            {
              "status": "affected",
              "version": "2.19.274"
            },
            {
              "lessThan": "2.19.274",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "WhatsApp for iOS",
          "vendor": "Facebook",
          "versions": [
            {
              "status": "affected",
              "version": "2.19.100"
            },
            {
              "lessThan": "2.19.100",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "WhatsApp for Windows Phone",
          "vendor": "Facebook",
          "versions": [
            {
              "lessThanOrEqual": "2.18.368",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "WhatsApp Enterprise Client",
          "vendor": "Facebook",
          "versions": [
            {
              "status": "affected",
              "version": "2.25.3"
            },
            {
              "lessThan": "2.25.3",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "WhatsApp Business for Android",
          "vendor": "Facebook",
          "versions": [
            {
              "status": "affected",
              "version": "2.19.104"
            },
            {
              "lessThan": "2.19.104",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "WhatsApp Business for iOS",
          "vendor": "Facebook",
          "versions": [
            {
              "status": "affected",
              "version": "2.19.100"
            },
            {
              "lessThan": "2.19.100",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "dateAssigned": "2019-11-14T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "A stack-based buffer overflow could be triggered in WhatsApp by sending a specially crafted MP4 file to a WhatsApp user. The issue was present in parsing the elementary stream metadata of an MP4 file and could result in a DoS or RCE. This affects Android versions prior to 2.19.274, iOS versions prior to 2.19.100, Enterprise Client versions prior to 2.25.3, Business for Android versions prior to 2.19.104 and Business for iOS versions prior to 2.19.100."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-121",
              "description": "Stack-based Buffer Overflow (CWE-121)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-11-14T22:55:52",
        "orgId": "4fc57720-52fe-4431-a0fb-3d2c8747b827",
        "shortName": "facebook"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.facebook.com/security/advisories/cve-2019-11931"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve-assign@fb.com",
          "DATE_ASSIGNED": "2019-11-14",
          "ID": "CVE-2019-11931",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "WhatsApp for Android",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "!=\u003e",
                            "version_value": "2.19.274"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "2.19.274"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "WhatsApp for iOS",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "!=\u003e",
                            "version_value": "2.19.100"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "2.19.100"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "WhatsApp for Windows Phone",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_value": "2.18.368"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "WhatsApp Enterprise Client",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "!=\u003e",
                            "version_value": "2.25.3"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "2.25.3"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "WhatsApp Business for Android",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "!=\u003e",
                            "version_value": "2.19.104"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "2.19.104"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "WhatsApp Business for iOS",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "!=\u003e",
                            "version_value": "2.19.100"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "2.19.100"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Facebook"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A stack-based buffer overflow could be triggered in WhatsApp by sending a specially crafted MP4 file to a WhatsApp user. The issue was present in parsing the elementary stream metadata of an MP4 file and could result in a DoS or RCE. This affects Android versions prior to 2.19.274, iOS versions prior to 2.19.100, Enterprise Client versions prior to 2.25.3, Business for Android versions prior to 2.19.104 and Business for iOS versions prior to 2.19.100."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Stack-based Buffer Overflow (CWE-121)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.facebook.com/security/advisories/cve-2019-11931",
              "refsource": "CONFIRM",
              "url": "https://www.facebook.com/security/advisories/cve-2019-11931"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4fc57720-52fe-4431-a0fb-3d2c8747b827",
    "assignerShortName": "facebook",
    "cveId": "CVE-2019-11931",
    "datePublished": "2019-11-14T22:55:52",
    "dateReserved": "2019-05-13T00:00:00",
    "dateUpdated": "2024-08-04T23:10:29.691Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-6C69-F792-7PQ7

CVE-2019-11931 (GCVE-0-2019-11931)

Tags

Sightings

Nomenclature