Skip to content
OpenAdvisories
High · 7.5 CVE-2020-0767 EUVD-2022-3785GHSA-fhc8-h6hr-h9mq

ChakraCore RCE Vulnerability

Published Feb 11, 2020 · Updated Aug 4, 2024 · Assigned by microsoft

Vendor: Microsoft Product: ChakraCore Product: Microsoft Edge (EdgeHTML-based) on Windows 10 for 32-bit Systems Product: Microsoft Edge (EdgeHTML-based) on Windows 10 for x64-based Systems Product: Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1607 for 32-bit Systems Product: Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1607 for x64-based Systems Product: Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1709 for 32-bit Systems Product: Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1709 for ARM64-based Systems Product: Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1709 for x64-based Systems Product: Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1803 for 32-bit Systems Product: Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1803 for ARM64-based Systems Product: Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1803 for x64-based Systems Product: Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1809 for 32-bit Systems Product: Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1809 for ARM64-based Systems Product: Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1809 for x64-based Systems Product: Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1903 for 32-bit Systems Product: Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1903 for ARM64-based Systems Product: Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1903 for x64-based Systems Product: Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1909 for 32-bit Systems Product: Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1909 for ARM64-based Systems Product: Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1909 for x64-based Systems Product: Microsoft Edge (EdgeHTML-based) on Windows Server 2016 Product: Microsoft Edge (EdgeHTML-based) on Windows Server 2019 Package: Microsoft.ChakraCore Platform: Windows Category: Browsers Ecosystem: NuGet

Description

A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2020-0673, CVE-2020-0674, CVE-2020-0710, CVE-2020-0711, CVE-2020-0712, CVE-2020-0713.

Affected products

VendorProductAffectedFixed
Microsoft ChakraCore unspecified —
Microsoft Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1803 for 32-bit Systems unspecified —
Microsoft Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1803 for x64-based Systems unspecified —
Microsoft Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1803 for ARM64-based Systems unspecified —
Microsoft Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1809 for 32-bit Systems unspecified —
Microsoft Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1809 for x64-based Systems unspecified —
Microsoft Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1809 for ARM64-based Systems unspecified —
Microsoft Microsoft Edge (EdgeHTML-based) on Windows Server 2019 unspecified —
Microsoft Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1709 for 32-bit Systems unspecified —
Microsoft Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1709 for x64-based Systems unspecified —
Microsoft Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1709 for ARM64-based Systems unspecified —
Microsoft Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1903 for 32-bit Systems unspecified —
Microsoft Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1903 for x64-based Systems unspecified —
Microsoft Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1903 for ARM64-based Systems unspecified —
Microsoft Microsoft Edge (EdgeHTML-based) on Windows 10 for 32-bit Systems unspecified —
Microsoft Microsoft Edge (EdgeHTML-based) on Windows 10 for x64-based Systems unspecified —
Microsoft Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1607 for 32-bit Systems unspecified —
Microsoft Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1607 for x64-based Systems unspecified —
Microsoft Microsoft Edge (EdgeHTML-based) on Windows Server 2016 unspecified —
Microsoft Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1909 for ARM64-based Systems unspecified —
Microsoft Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1909 for 32-bit Systems unspecified —
Microsoft Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1909 for x64-based Systems unspecified —

Affected packages

EcosystemPackageAffectedFixedRecord
NuGet Microsoft.ChakraCore < 1.11.16 1.11.16 GHSA-fhc8-h6hr-h9mq

References