CVE-2017-0252 ChakraCore RCE Vulnerability
CriticalCVSS 9.8
EPSS 13.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
A remote code execution vulnerability exists in Microsoft Chakra Core in the way JavaScript engines render when handling objects in memory. aka "Scripting Engine Memory Corruption Vulnerability". This vulnerability is unique from CVE-2017-0223.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| nuget Microsoft.ChakraCore(NuGet) | < 1.4.4 | 1.4.4 |
| nuget Microsoft.ChakraCore(NuGet) | = 1.2.0 | No fix listed |
| nuget Microsoft.ChakraCore(NuGet) | = 1.2.1 | No fix listed |
| nuget Microsoft.ChakraCore(NuGet) | = 1.2.2 | No fix listed |
| nuget Microsoft.ChakraCore(NuGet) | = 1.2.3 | No fix listed |
| nuget Microsoft.ChakraCore(NuGet) | = 1.2.6.62716-preview | No fix listed |
| nuget Microsoft.ChakraCore(NuGet) | = 1.3.0 | No fix listed |
| nuget Microsoft.ChakraCore(NuGet) | = 1.3.1 | No fix listed |
| nuget Microsoft.ChakraCore(NuGet) | = 1.3.2 | No fix listed |
| nuget Microsoft.ChakraCore(NuGet) | = 1.4.0 | No fix listed |
| nuget Microsoft.ChakraCore(NuGet) | = 1.4.1 | No fix listed |
| nuget Microsoft.ChakraCore(NuGet) | = 1.4.2 | No fix listed |
| nuget Microsoft.ChakraCore(NuGet) | = 1.4.3 | No fix listed |
| Microsoft edge | All versions | No fix listed |
| Microsoft Chakra Core | All versions | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch third-party-advisory
- github.com patch
- github.com
- github.com product