GitHub Advisoryadvisory · NuGet
GHSA-h6m7-jphx-f9p5 ChakraCore information disclosure vulnerability
MEDIUM
Official page ↗
- Aliases
- CVE-2017-8659
- Ecosystem
- NuGet
- Packages
- Microsoft.ChakraCore
- Severity
- Moderate
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
- Weaknesses
- CWE-200
- Reviewed
- 2023-07-27
Affected packages
• NuGet Microsoft.ChakraCore: < 1.6.1 → fixed in 1.6.1
Description
Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to obtain information to further compromise the user's system due to the Chakra scripting engine not properly handling objects in memory, aka "Scripting Engine Information Disclosure Vulnerability".
Related
Alias · CVE (1)
- CVE-2017-8659 Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to obtain information to further compromise the user's system due to the… vulnerability
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2017-8659 advisory
- https://github.com/chakra-core/ChakraCore/pull/3509 web
- https://github.com/chakra-core/ChakraCore/commit/2500e1cdc12cb35af73d5c8c9b85656aba6bab4d web
- https://github.com/chakra-core/ChakraCore package
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8659 web
- https://web.archive.org/web/20210612224703/http://www.securityfocus.com/bid/100029 web
- https://web.archive.org/web/20211127144809/http://www.securitytracker.com/id/1039095 web