CVE-2019-3568

Katalog CVE

CVSS 9.8 · Critical KEV · sudah dieksploitasi EPSS 30,1%

Kerentanan Heap-based Buffer Overflow pada whatsapp, whatsapp business. Skor CVSS 3.1 9.8 (Critical) menurut NVD. Masuk katalog KEV CISA pada 19 April 2022, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RTCP packets sent to a target phone number. The issue affects WhatsApp for Android prior to v2.19.134, WhatsApp Business for Android prior to v2.19.44, WhatsApp for iOS prior to v2.19.51, WhatsApp Business for iOS prior to v2.19.51, WhatsApp for Windows Phone prior to v2.18.348, and WhatsApp for Tizen prior to v2.18.15.

Rincian

Terbit di NVD

14 Mei 2019

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-122: Heap-based Buffer Overflow
CWE-787: Out-of-bounds Write

EPSS (30 hari)

30,1% peluang dieksploitasi; lebih tinggi dari 98,1% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

WhatsApp VOIP Stack Buffer Overflow Vulnerability

Masuk KEV

19 April 2022

Tenggat CISA

10 Mei 2022 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply updates per vendor instructions.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-3568 pemerintah AS
• http://www.securityfocus.com/bid/108329 broken link · advisory pihak ketiga · vdb entry
• https://www.facebook.com/security/advisories/cve-2019-3568 advisory pihak ketiga