PT-2017-12307 · Microsoft+2 · Chakracore+1

Publicado 2017-12-12 · Atualizado 2022-05-17 · CVE-2017-11916

NVD

CVSS v2.0

7.6

Alta

Vetor base

AV:N/AC:H/Au:N/C:C/I:C/A:C

ChakraCore allows an attacker to execute arbitrary code in the context of the current user, due to how the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11886, CVE-2017-11889, CVE-2017-11890, CVE-2017-11893, CVE-2017-11894, CVE-2017-11895, CVE-2017-11901, CVE-2017-11903, CVE-2017-11905, CVE-2017-11905, CVE-2017-11907, CVE-2017-11908, CVE-2017-11909, CVE-2017-11910, CVE-2017-11911, CVE-2017-11912, CVE-2017-11913, CVE-2017-11914, CVE-2017-11918, and CVE-2017-11930.

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2017-11916

GHSA-5F5R-65PM-R3WR

Produtos afetados

Chakracore

Microsoft.Chakracore

Referências · 8

• https://github.com/chakra-core/ChakraCore/pull/4411 · Nota
• https://github.com/chakra-core/ChakraCore/commit/69e03c35543d2bf3befce6885d78cd751bf5db10 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-11916 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-11916 · Aviso do Fabricante
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11916 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-5f5r-65pm-r3wr · Aviso do Fabricante
• http://securityfocus.com/bid/102090 · Nota
• https://web.archive.org/web/20210124122737/http://securityfocus.com/bid/102090 · Nota