GHSA-p97q-j98q-f98w
ChakraCore RCE Vulnerability
At a glance
- Published
- Updated
- CVE
- CVE-2018-8287
- CVSS_V3
- CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Description
A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka "Scripting Engine Memory Corruption Vulnerability." This affects ChakraCore, Internet Explorer 11, Microsoft Edge, Internet Explorer 10. This CVE ID is unique from CVE-2018-8242, CVE-2018-8283, CVE-2018-8288, CVE-2018-8291, CVE-2018-8296, CVE-2018-8298.
Affected packages
| Package | Versions |
|---|---|
| NuGet · Microsoft.ChakraCore | introduced 0, fixed 1.10.1 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2018-8287 ADVISORY
- https://github.com/chakra-core/ChakraCore/pull/5444 WEB
- https://github.com/chakra-core/ChakraCore/commit/fa89a7031e75ca8b4a595765e897e8fc0d9fae76 WEB
- https://github.com/chakra-core/ChakraCore PACKAGE
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8287 WEB
- https://web.archive.org/web/20210125211352/http://www.securityfocus.com/bid/104634 WEB
- https://web.archive.org/web/20211202002348/http://www.securitytracker.com/id/1041256 WEB
- https://web.archive.org/web/20220120050525/http://www.securitytracker.com/id/1041258 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |