GHSA-h9wf-mpvf-9jqg
ChakraCore RCE Vulnerability
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2018-0837
- CVSS_V3
- CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Description
Microsoft Edge and ChakraCore in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2018-0834, CVE-2018-0835, CVE-2018-0836, CVE-2018-0838, CVE-2018-0840, CVE-2018-0856, CVE-2018-0857, CVE-2018-0858, CVE-2018-0859, CVE-2018-0860, CVE-2018-0861, and CVE-2018-0866.
Paquets affectés
| Paquet | Versions |
|---|---|
| NuGet · Microsoft.ChakraCore | introduced 0, fixed 1.8.1 |
Références
- https://nvd.nist.gov/vuln/detail/CVE-2018-0837 ADVISORY
- https://github.com/chakra-core/ChakraCore/commit/043257b7d47afab1240f5dd4cdd10bde38c574c3 WEB
- https://github.com/chakra-core/ChakraCore PACKAGE
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0837 WEB
- https://web.archive.org/web/20210805203751/http://www.securityfocus.com/bid/102876 WEB
- https://web.archive.org/web/20211208072939/http://www.securitytracker.com/id/1040372 WEB
- https://www.exploit-db.com/exploits/44081 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |