« Volver al listado

CVE-2018-20655

Estado: ModificadaCrítica (9.8)—

When receiving calls using WhatsApp for iOS, a missing size check when parsing a sender-provided packet allowed for a stack-based overflow. This issue affects WhatsApp for iOS prior to v2.18.90.24 and WhatsApp Business for iOS prior to v2.18.90.24.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Whatsapp — WhatsappWhatsapp — Whatsapp Business

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2018-20655",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve-assign@fb.com",
      "affectedData": [
        {
          "vendor": "Facebook",
          "product": "WhatsApp for iOS",
          "versions": [
            {
              "status": "affected",
              "version": "2.18.90.24"
            },
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "2.18.90.24",
              "versionType": "custom"
            }
          ]
        },
        {
          "vendor": "Facebook",
          "product": "WhatsApp Business for iOS",
          "versions": [
            {
              "status": "affected",
              "version": "2.18.90.24"
            },
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "2.18.90.24",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-06-14T17:29:01.050",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/108805",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "cve-assign@fb.com"
    },
    {
      "url": "https://www.facebook.com/security/advisories/cve-2018-20655/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cve-assign@fb.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/108805",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.facebook.com/security/advisories/cve-2018-20655/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cve-assign@fb.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-121"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "When receiving calls using WhatsApp for iOS, a missing size check when parsing a sender-provided packet allowed for a stack-based overflow. This issue affects WhatsApp for iOS prior to v2.18.90.24 and WhatsApp Business for iOS prior to v2.18.90.24."
    },
    {
      "lang": "es",
      "value": "Cuando se reciben llamadas con WhatsApp para iOS, una falta de comprobación de tamaño al analizar un paquete proporcionado por el remitente permite un desbordamiento basado en la pila. Este problema afecta a WhatsApp para iOS anterior a versión v2.18.90.24 y WhatsApp Business para iOS anterior a versión v2.18.90.24."
    }
  ],
  "lastModified": "2026-06-17T01:53:16.400",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:whatsapp:whatsapp:*:*:*:*:*:iphone_os:*:*",
              "vulnerable": true,
              "matchCriteriaId": "33D5A648-8238-4037-8276-00CB8FA95E80",
              "versionEndExcluding": "2.18.90.24"
            },
            {
              "criteria": "cpe:2.3:a:whatsapp:whatsapp_business:*:*:*:*:*:iphone_os:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5022E01B-85D5-45E5-93DE-BD1DC04D2528",
              "versionEndExcluding": "2.18.90.24"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve-assign@fb.com"
}