GHSA-fw42-4mq4-4qpq

ChakraCore RCE Vulnerability

Source: GitHub Advisory Database (reviewed) Critical CVE-2018-8500

Packages

Ecosystem	Package	Affected	Fixed in
NuGet	Microsoft.ChakraCore	< 1.11.2	1.11.2

Details

As written in the advisory (Markdown source, shown as plain text).

A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability." This affects ChakraCore.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2018-8500 advisory
https://github.com/chakra-core/ChakraCore/pull/5764 web
https://github.com/chakra-core/ChakraCore/commit/cd84a0b85b4b2bcf1653c7bfd5426bbc72b2b216 web
https://github.com/chakra-core/ChakraCore package
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8500 web
https://web.archive.org/web/20210124210846/http://www.securityfocus.com/bid/105463 web