GitHub Advisoryadvisory · NuGet
GHSA-h5hw-qrrw-vfxg ChakraCore RCE Vulnerability
HIGH
Official page ↗
- Aliases
- CVE-2018-0954
- Ecosystem
- NuGet
- Packages
- Microsoft.ChakraCore
- Severity
- High
- CVSS vector
- CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-787
- Reviewed
- 2023-07-21
Affected packages
• NuGet Microsoft.ChakraCore: < 1.8.4 → fixed in 1.8.4
Description
A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka "Scripting Engine Memory Corruption Vulnerability." This affects Internet Explorer 9, ChakraCore, Internet Explorer 11, Microsoft Edge, Internet Explorer 10. This CVE ID is unique from CVE-2018-0945, CVE-2018-0946, CVE-2018-0951, CVE-2018-0953, CVE-2018-0955, CVE-2018-1022, CVE-2018-8114, CVE-2018-8122, CVE-2018-8128, CVE-2018-8137, CVE-2018-8139.
Related
Alias · CVE (1)
- CVE-2018-0954 A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka… vulnerability
Weakness · CWE (1)
- CWE-787 Out-of-bounds Write weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2018-0954 advisory
- https://github.com/chakra-core/ChakraCore/commit/51c46371c917e87bbde77d66abba088309d96a3f web
- https://github.com/chakra-core/ChakraCore package
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0954 web
- https://web.archive.org/web/20210124164423/http://www.securityfocus.com/bid/103991 web
- https://web.archive.org/web/20211204185256/http://www.securitytracker.com/id/1040844 web