GHSA-v3xp-3wpq-rvhp
ChakraCore RCE Vulnerability
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2018-0860
- CVSS_V3
- CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Description
Microsoft Edge and ChakraCore in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2018-0834, CVE-2018-0835, CVE-2018-0836, CVE-2018-0837, CVE-2018-0838, CVE-2018-0840, CVE-2018-0856, CVE-2018-0857, CVE-2018-0858, CVE-2018-0859, CVE-2018-0861, and CVE-2018-0866.
Paquets affectés
| Paquet | Versions |
|---|---|
| NuGet · Microsoft.ChakraCore | introduced 0, fixed 1.8.1 |
Références
- https://nvd.nist.gov/vuln/detail/CVE-2018-0860 ADVISORY
- https://github.com/chakra-core/ChakraCore/commit/9dac38fa6a6273f4cd57234d3caf4c7033e527bc WEB
- https://github.com/chakra-core/ChakraCore PACKAGE
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0860 WEB
- https://web.archive.org/web/20210124135855/http://www.securityfocus.com/bid/102883 WEB
- https://web.archive.org/web/20210922050621/http://www.securitytracker.com/id/1040372 WEB
- https://www.exploit-db.com/exploits/44076 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |