Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1oNmczLTczaDctY2h4cM4AAVbs

ChakraCore RCE Vulnerability

The Microsoft (1) JScript 9, (2) VBScript, and (3) Chakra JavaScript engines, as used in Microsoft Internet Explorer 11, Microsoft Edge, and other products, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability."

Permalink: https://github.com/advisories/GHSA-h6g3-73h7-chxp
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1oNmczLTczaDctY2h4cM4AAVbs
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: almost 2 years ago
Updated: 6 months ago

CVSS Score: 8.8
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Identifiers: GHSA-h6g3-73h7-chxp, CVE-2016-3260
References:

• https://nvd.nist.gov/vuln/detail/CVE-2016-3260
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-084
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-085
• https://github.com/chakra-core/ChakraCore/pull/1291
• https://github.com/chakra-core/ChakraCore/commit/17f3d4a4852dcc9e48de7091685b1862afb9f307
• https://web.archive.org/web/20210123150650/http://www.securityfocus.com/bid/91580
• https://web.archive.org/web/20211202003833/http://www.securitytracker.com/id/1036283
• https://github.com/advisories/GHSA-h6g3-73h7-chxp

Repository: https://github.com/chakra-core/ChakraCore
Blast Radius: 1.0

Affected Packages