GHSA-6p7q-85qq-7c43
ChakraCore RCE Vulnerability
At a glance
- Published
- Updated
- CVE
- CVE-2017-0234
- CVSS_V3
- CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Description
A remote code execution vulnerability exists in Microsoft Edge in the way that the Chakra JavaScript engine renders when handling objects in memory, aka "Scripting Engine Memory Corruption Vulnerability." This CVE ID is unique from CVE-2017-0224, CVE-2017-0228, CVE-2017-0229, CVE-2017-0230, CVE-2017-0235, CVE-2017-0236, and CVE-2017-0238.
Affected packages
| Package | Versions |
|---|---|
| NuGet · Microsoft.ChakraCore | introduced 0, fixed 1.4.4 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2017-0234 ADVISORY
- https://github.com/chakra-core/ChakraCore/pull/2959 WEB
- https://github.com/chakra-core/ChakraCore/commit/a1345ad48064921e8eb45fa0297ce405a7df14d3 WEB
- https://github.com/chakra-core/ChakraCore PACKAGE
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0234 WEB
- https://web.archive.org/web/20210124044042/http://www.securityfocus.com/bid/98229 WEB
- https://web.archive.org/web/20211019191652/http://www.securitytracker.com/id/1038431 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |