GitHub Advisoryadvisory · NuGet

GHSA-ww6f-76ff-phhj ChakraCore RCE Vulnerability

HIGH Published 2022-05-14 Modified 2023-11-02 Official page ↗
Aliases
CVE-2016-3202
Ecosystem
NuGet
Packages
Microsoft.ChakraCore
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-119
Reviewed
2023-07-31

Affected packages

• NuGet Microsoft.ChakraCore: < 1.2.0.0 → fixed in 1.2.0.0

Description

The Microsoft (1) Chakra JavaScript, (2) JScript, and (3) VBScript engines, as used in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability."

Related

Alias · CVE (1)

  • CVE-2016-3202 The Microsoft (1) Chakra JavaScript, (2) JScript, and (3) VBScript engines, as used in Microsoft Internet Explorer 10 and 11 and Microsoft… vulnerability

Weakness · CWE (1)

  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer weakness

References