PT-2016-2884 · Microsoft · Chakra Javascript Engine+3

Publicado 2016-10-11 · Atualizado 2022-05-14 · CVE-2016-3390

Positive Technologies (AI Summary)

CVSS v2.0

7.6

Alta

Vetor base

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer 11 (affected versions not specified) Microsoft Edge (affected versions not specified)

Description The issue is related to the scripting engines in Microsoft browsers, allowing remote attackers to execute arbitrary code or cause a denial of service due to memory corruption. This can occur via a crafted web site, exploiting the Chakra JavaScript engine. The vulnerability may also allow an attacker to disclose accounts by analyzing a memory dump. Multiple remote code execution vulnerabilities exist in the way the Scripting Engine handles objects in memory.

Recommendations For Microsoft Internet Explorer 11, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Microsoft Edge, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

DoS

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

BDU:2016-02315

CVE-2016-3390

GHSA-F7P4-FMMH-4P8X

Produtos afetados

Chakra Javascript Engine

Edge

Internet Explorer

Internet Explorer 11

Referências · 20

• https://github.com/chakra-core/ChakraCore · Nota
• https://github.com/chakra-core/ChakraCore/pull/1737 · Nota
• https://github.com/chakra-core/ChakraCore/commit/f05c42e64c3b2d057ae1a52fe1917af26c9f2737 · Nota
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-118 · Aviso do Fabricante
• http://technet.microsoft.com/library/security/MS16-118 · Nota
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-119 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-3390 · Nota de Segurança
• https://bdu.fstec.ru/vul/2016-02315 · Nota de Segurança
• http://technet.microsoft.com/security/bulletin/MS16-119 · Nota
• https://osv.dev/vulnerability/CVE-2016-3390 · Aviso do Fabricante
• http://securityfocus.com/bid/93383 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3390 · Nota de Segurança
• http://securitytracker.com/id/1036993 · Nota
• http://technet.microsoft.com/security/bulletin/MS16-118 · Nota
• http://technet.microsoft.com/library/security/MS16-119 · Nota