GitHub Advisoryadvisory · NuGet
GHSA-6p7q-85qq-7c43 ChakraCore RCE Vulnerability
HIGH
Official page ↗
- Aliases
- CVE-2017-0234
- Ecosystem
- NuGet
- Packages
- Microsoft.ChakraCore
- Severity
- High
- CVSS vector
- CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-119
- Reviewed
- 2023-07-27
Affected packages
• NuGet Microsoft.ChakraCore: < 1.4.4 → fixed in 1.4.4
Description
A remote code execution vulnerability exists in Microsoft Edge in the way that the Chakra JavaScript engine renders when handling objects in memory, aka "Scripting Engine Memory Corruption Vulnerability." This CVE ID is unique from CVE-2017-0224, CVE-2017-0228, CVE-2017-0229, CVE-2017-0230, CVE-2017-0235, CVE-2017-0236, and CVE-2017-0238.
Related
Alias · CVE (1)
- CVE-2017-0234 A remote code execution vulnerability exists in Microsoft Edge in the way that the Chakra JavaScript engine renders when handling objects… vulnerability
Weakness · CWE (1)
- CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2017-0234 advisory
- https://github.com/chakra-core/ChakraCore/pull/2959 web
- https://github.com/chakra-core/ChakraCore/commit/a1345ad48064921e8eb45fa0297ce405a7df14d3 web
- https://github.com/chakra-core/ChakraCore package
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0234 web
- https://web.archive.org/web/20210124044042/http://www.securityfocus.com/bid/98229 web
- https://web.archive.org/web/20211019191652/http://www.securitytracker.com/id/1038431 web