GHSA-xgcc-r2f3-rq6p

ChakraCore information disclosure vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2018-0939

Packages

Ecosystem	Package	Affected	Fixed in
NuGet	Microsoft.ChakraCore	< 1.8.2	1.8.2

Details

As written in the advisory (Markdown source, shown as plain text).

ChakraCore and Microsoft Edge in Windows 10 1703 and 1709 allow information disclosure, due to how the scripting engine handles objects in memory, aka "Scripting Engine Information Disclosure Vulnerability". This CVE ID is unique from CVE-2018-0891.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2018-0939 advisory
https://github.com/chakra-core/ChakraCore/commit/090277e7a5ea1d938777acb92e7b6759936ea974 web
https://github.com/chakra-core/ChakraCore package
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0939 web
https://web.archive.org/web/20201021051922/http://www.securitytracker.com/id/1040507 web
https://web.archive.org/web/20210124145017/http://www.securityfocus.com/bid/103305 web