GitHub Advisoryadvisory · NuGet

GHSA-h6g3-73h7-chxp ChakraCore RCE Vulnerability

HIGH Published 2022-05-14 Modified 2023-11-02 Official page ↗
Aliases
CVE-2016-3260
Ecosystem
NuGet
Packages
Microsoft.ChakraCore
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-119
Reviewed
2023-07-31

Affected packages

• NuGet Microsoft.ChakraCore: < 1.2.0.0 → fixed in 1.2.0.0

Description

The Microsoft (1) JScript 9, (2) VBScript, and (3) Chakra JavaScript engines, as used in Microsoft Internet Explorer 11, Microsoft Edge, and other products, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability."

Related

Alias · CVE (1)

  • CVE-2016-3260 The Microsoft (1) JScript 9, (2) VBScript, and (3) Chakra JavaScript engines, as used in Microsoft Internet Explorer 11, Microsoft Edge,… vulnerability

Weakness · CWE (1)

  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer weakness

References