PT-2016-2884 · Microsoft · Chakra Javascript Engine+3

Published 2016-10-11 · Updated 2022-05-14 · CVE-2016-3390

Positive Technologies (AI Summary)

CVSS v2.0

7.6

High

Base vector

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer 11 (affected versions not specified) Microsoft Edge (affected versions not specified)

Description The issue is related to the scripting engines in Microsoft browsers, allowing remote attackers to execute arbitrary code or cause a denial of service due to memory corruption. This can occur via a crafted web site, exploiting the Chakra JavaScript engine. The vulnerability may also allow an attacker to disclose accounts by analyzing a memory dump. Multiple remote code execution vulnerabilities exist in the way the Scripting Engine handles objects in memory.

Recommendations For Microsoft Internet Explorer 11, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Microsoft Edge, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2016-02315

CVE-2016-3390

GHSA-F7P4-FMMH-4P8X

Affected Products

Chakra Javascript Engine

Edge

Internet Explorer

Internet Explorer 11

References · 20

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-118 · Vendor Advisory
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-119 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-3390 · Security Note
• https://bdu.fstec.ru/vul/2016-02315 · Security Note
• https://osv.dev/vulnerability/CVE-2016-3390 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3390 · Security Note
• https://osv.dev/vulnerability/GHSA-f7p4-fmmh-4p8x · Vendor Advisory
• https://github.com/chakra-core/ChakraCore · Note
• https://github.com/chakra-core/ChakraCore/pull/1737 · Note
• https://github.com/chakra-core/ChakraCore/commit/f05c42e64c3b2d057ae1a52fe1917af26c9f2737 · Note
• http://technet.microsoft.com/library/security/MS16-118 · Note
• http://technet.microsoft.com/security/bulletin/MS16-119 · Note
• http://securityfocus.com/bid/93383 · Note
• http://securitytracker.com/id/1036993 · Note
• http://technet.microsoft.com/security/bulletin/MS16-118 · Note