GHSA-pjpr-2qqp-gprf
ChakraCore information disclosure vulnerability
At a glance
- Published
- Updated
- CVE
- CVE-2017-0208
- CVSS_V3
- CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Description
An information disclosure vulnerability exists in Microsoft Edge when the Chakra scripting engine does not properly handle objects in memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user's system, a.k.a. "Scripting Engine Information Disclosure Vulnerability."
Affected packages
| Package | Versions |
|---|---|
| NuGet · Microsoft.ChakraCore | introduced 0, fixed 1.4.3 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2017-0208 ADVISORY
- https://github.com/chakra-core/ChakraCore/pull/2834 WEB
- https://github.com/chakra-core/ChakraCore/commit/54d6d085987e2c399863940179db67b594d7f0a3 WEB
- https://github.com/chakra-core/ChakraCore PACKAGE
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0208 WEB
- https://web.archive.org/web/20210124023848/http://www.securityfocus.com/bid/97460 WEB
- https://web.archive.org/web/20211201121401/http://www.securitytracker.com/id/1038234 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |