GHSA-c79v-2rjq-965m
ChakraCore vulnerable to privilege escalation
At a glance
- Published
- Updated
- CVE
- CVE-2017-11767
- CVSS_V3
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
ChakraCore allows an attacker to gain the same user rights as the current user, due to the way that the ChakraCore scripting engine handles objects in memory. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
Affected packages
| Package | Versions |
|---|---|
| NuGet · Microsoft.ChakraCore | introduced 0, fixed 1.6.2 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2017-11767 ADVISORY
- https://github.com/chakra-core/ChakraCore/pull/3727 WEB
- https://github.com/chakra-core/ChakraCore/pull/3727/commits/b3e3959d14814f42ee2197c504c322bcbe12347d WEB
- https://github.com/chakra-core/ChakraCore/commit/b3e3959d14814f42ee2197c504c322bcbe12347d WEB
- https://github.com/chakra-core/ChakraCore PACKAGE
- https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2017-11767 WEB
- https://web.archive.org/web/20210124103810/http://www.securityfocus.com/bid/100838 WEB
- https://web.archive.org/web/20211127230635/http://www.securitytracker.com/id/1039369 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |