GHSA-wg47-6cqc-q52j
ChakraCore Security Bypass
At a glance
- Published
- Updated
- CVE
- CVE-2018-8276
- CVSS_V3
- CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Description
A security feature bypass vulnerability exists in the Microsoft Chakra scripting engine that allows Control Flow Guard (CFG) to be bypassed, aka "Scripting Engine Security Feature Bypass Vulnerability." This affects Microsoft Edge, ChakraCore.
Affected packages
| Package | Versions |
|---|---|
| NuGet · Microsoft.ChakraCore | introduced 0, fixed 1.10.1 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2018-8276 ADVISORY
- https://github.com/chakra-core/ChakraCore/commit/4196f8097afdcc5fe01ce2966871712fb24003a3 WEB
- https://github.com/chakra-core/ChakraCore PACKAGE
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8276 WEB
- https://web.archive.org/web/20210124183457/http://www.securityfocus.com/bid/104626 WEB
- https://web.archive.org/web/20211202002348/http://www.securitytracker.com/id/1041256 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |