CVE-2020-1894: 
NixOS vulnerability analysis and mitigation

A stack write overflow vulnerability (CVE-2020-1894) was discovered in WhatsApp applications across multiple platforms. The vulnerability affected WhatsApp for Android prior to v2.20.35, WhatsApp Business for Android prior to v2.20.20, WhatsApp for iPhone prior to v2.20.30, and WhatsApp Business for iPhone prior to v2.20.30. The vulnerability was disclosed through WhatsApp's dedicated security advisory site (Vendor Advisory).

The vulnerability is classified as an out-of-bounds write (CWE-787) with a CVSS v3.1 base score of 8.8 (HIGH). The attack vector is network-based (AV:N) with low attack complexity (AC:L), requiring no privileges (PR:N) but user interaction (UI:R). The scope is unchanged (S:U) with high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H) (NVD).

The vulnerability could allow arbitrary code execution when playing a specially crafted push-to-talk message, potentially compromising the security of affected devices and user data (GBHackers).

The vulnerability requires user interaction through playing a specially crafted push-to-talk message to be exploited. The attack can be executed remotely over the network, making it accessible to potential attackers without requiring local access (NVD).

Users should update their WhatsApp applications to the following versions or newer: WhatsApp for Android to v2.20.35, WhatsApp Business for Android to v2.20.20, WhatsApp for iPhone to v2.20.30, and WhatsApp Business for iPhone to v2.20.30 (Vendor Advisory).

WhatsApp addressed this vulnerability as part of their commitment to user security, stating 'We take the security of our users very seriously and we provide industry-leading protection for our users around the world.' The vulnerability was disclosed alongside five other security bugs, demonstrating WhatsApp's proactive approach to security transparency (GBHackers).