GHSA-67x3-36j7-pj4g
ChakraCore RCE Vulnerability
At a glance
- Published
- Updated
- CVE
- CVE-2018-8385
- CVSS_V3
- CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Description
A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka "Scripting Engine Memory Corruption Vulnerability." This affects Internet Explorer 9, ChakraCore, Internet Explorer 11, Microsoft Edge, Internet Explorer 10. This CVE ID is unique from CVE-2018-8353, CVE-2018-8355, CVE-2018-8359, CVE-2018-8371, CVE-2018-8372, CVE-2018-8373, CVE-2018-8389, CVE-2018-8390.
Affected packages
| Package | Versions |
|---|---|
| NuGet · Microsoft.ChakraCore | introduced 0, fixed 1.10.2 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2018-8385 ADVISORY
- https://github.com/chakra-core/ChakraCore/pull/5596 WEB
- https://github.com/chakra-core/ChakraCore/commit/f00612bbc3657f1ec33a9e7d575c16a5489d06aa WEB
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8385 WEB
- https://web.archive.org/web/20210124195607/http://www.securityfocus.com/bid/105039 WEB
- https://web.archive.org/web/20211203061111/http://www.securitytracker.com/id/1041457 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |