PT-2017-12307 · Microsoft+2 · Chakracore+1

Published 2017-12-12 · Updated 2022-05-17 · CVE-2017-11916

NVD

CVSS v2.0

7.6

High

Base vector

AV:N/AC:H/Au:N/C:C/I:C/A:C

ChakraCore allows an attacker to execute arbitrary code in the context of the current user, due to how the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11886, CVE-2017-11889, CVE-2017-11890, CVE-2017-11893, CVE-2017-11894, CVE-2017-11895, CVE-2017-11901, CVE-2017-11903, CVE-2017-11905, CVE-2017-11905, CVE-2017-11907, CVE-2017-11908, CVE-2017-11909, CVE-2017-11910, CVE-2017-11911, CVE-2017-11912, CVE-2017-11913, CVE-2017-11914, CVE-2017-11918, and CVE-2017-11930.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2017-11916

GHSA-5F5R-65PM-R3WR

Affected Products

Chakracore

Microsoft.Chakracore

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2017-11916 · Security Note
• https://osv.dev/vulnerability/CVE-2017-11916 · Vendor Advisory
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11916 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5f5r-65pm-r3wr · Vendor Advisory
• https://github.com/chakra-core/ChakraCore/pull/4411 · Note
• https://github.com/chakra-core/ChakraCore/commit/69e03c35543d2bf3befce6885d78cd751bf5db10 · Note
• http://securityfocus.com/bid/102090 · Note
• https://web.archive.org/web/20210124122737/http://securityfocus.com/bid/102090 · Note