GHSA-hrf4-ww4w-6rv6
ChakraCore RCE Vulnerability
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2017-11797
- CVSS_V3
- CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Description
ChakraCore allows an attacker to execute arbitrary code in the context of the current user, due to how the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-11792, CVE-2017-11793, CVE-2017-11796, CVE-2017-11798, CVE-2017-11799, CVE-2017-11800, CVE-2017-11801, CVE-2017-11802, CVE-2017-11804, CVE-2017-11805, CVE-2017-11806, CVE-2017-11807, CVE-2017-11808, CVE-2017-11809, CVE-2017-11810, CVE-2017-11811, CVE-2017-11812, and CVE-2017-11821.
Paquets affectés
| Paquet | Versions |
|---|---|
| NuGet · Microsoft.ChakraCore | introduced 0, fixed 1.7.3 |
Références
- https://nvd.nist.gov/vuln/detail/CVE-2017-11797 ADVISORY
- https://github.com/chakra-core/ChakraCore/pull/3917 WEB
- https://github.com/chakra-core/ChakraCore/commit/9a3ad7ccba1fae1549e21369982d59d45a2ab6cf WEB
- https://github.com/chakra-core/ChakraCore PACKAGE
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11797 WEB
- https://web.archive.org/web/20210124110143/http://www.securityfocus.com/bid/101145 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |