GHSA-j67m-wpv6-pv44
ChakraCore RCE Vulnerability
At a glance
- Published
- Updated
- CVE
- CVE-2018-8291
- CVSS_V3
- CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Description
A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka "Scripting Engine Memory Corruption Vulnerability." This affects ChakraCore, Internet Explorer 11, Microsoft Edge. This CVE ID is unique from CVE-2018-8242, CVE-2018-8283, CVE-2018-8287, CVE-2018-8288, CVE-2018-8296, CVE-2018-8298.
Affected packages
| Package | Versions |
|---|---|
| NuGet · Microsoft.ChakraCore | introduced 0, fixed 1.10.1 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2018-8291 ADVISORY
- https://github.com/chakra-core/ChakraCore/pull/5444 WEB
- https://github.com/chakra-core/ChakraCore/commit/c322694178ece209b0aa73eafd97a036def86eb1 WEB
- https://github.com/chakra-core/ChakraCore PACKAGE
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8291 WEB
- https://web.archive.org/web/20210124183732/http://www.securityfocus.com/bid/104637 WEB
- https://web.archive.org/web/20210515050150/http://www.securitytracker.com/id/1041258 WEB
- https://web.archive.org/web/20211202002348/http://www.securitytracker.com/id/1041256 WEB
- https://www.exploit-db.com/exploits/45215 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |