Facebook has patched a critical zero-day vulnerability in WhatsApp that can and has been exploited to remotely install spyware on phones by calling the targeted device.
The flaw, tracked as CVE-2019-3568, has been described by Facebook as a buffer overflow in the WhatsApp VOIP stack. The security hole allows an attacker to remotely execute arbitrary code by sending specially crafted SRTCP packets to the targeted phone number.
Facebook addressed the vulnerability on Monday with the release of WhatsApp for Android 2.19.134, WhatsApp Business for Android 2.19.44, WhatsApp for iOS 2.19.51, WhatsApp Business for iOS 2.19.51, WhatsApp for Windows Phone 2.18.348, and WhatsApp for Tizen 2.18.15. Prior versions are impacted. A server-side fix was implemented on Friday.
Full Article.
