Skip to content
OpenAdvisories
High · 8.1 CVE-2020-1073 EUVD-2022-3875GHSA-g3m9-qrfj-xw4g

ChakraCore RCE Vulnerability

Published Jun 9, 2020 · Updated Aug 4, 2024 · Assigned by microsoft

Vendor: Microsoft Product: ChakraCore Product: Microsoft Edge (EdgeHTML-based) on Windows 10 for 32-bit Systems Product: Microsoft Edge (EdgeHTML-based) on Windows 10 for x64-based Systems Product: Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1607 for 32-bit Systems Product: Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1607 for x64-based Systems Product: Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1709 for 32-bit Systems Product: Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1709 for ARM64-based Systems Product: Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1709 for x64-based Systems Product: Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1803 for 32-bit Systems Product: Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1803 for ARM64-based Systems Product: Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1803 for x64-based Systems Product: Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1809 for 32-bit Systems Product: Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1809 for ARM64-based Systems Product: Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1809 for x64-based Systems Product: Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1903 for 32-bit Systems Product: Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1903 for ARM64-based Systems Product: Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1903 for x64-based Systems Product: Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1909 for 32-bit Systems Product: Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1909 for ARM64-based Systems Product: Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1909 for x64-based Systems Product: Microsoft Edge (EdgeHTML-based) on Windows Server 2016 Product: Microsoft Edge (EdgeHTML-based) on Windows Server 2019 Package: Microsoft.ChakraCore Platform: Windows Category: Browsers Ecosystem: NuGet

Description

A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting Engine Memory Corruption Vulnerability'.

Affected products

VendorProductAffectedFixed
Microsoft ChakraCore unspecified —
Microsoft Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1803 for 32-bit Systems unspecified —
Microsoft Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1803 for x64-based Systems unspecified —
Microsoft Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1803 for ARM64-based Systems unspecified —
Microsoft Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1809 for 32-bit Systems unspecified —
Microsoft Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1809 for x64-based Systems unspecified —
Microsoft Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1809 for ARM64-based Systems unspecified —
Microsoft Microsoft Edge (EdgeHTML-based) on Windows Server 2019 unspecified —
Microsoft Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1909 for 32-bit Systems unspecified —
Microsoft Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1909 for x64-based Systems unspecified —
Microsoft Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1909 for ARM64-based Systems unspecified —
Microsoft Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1709 for 32-bit Systems unspecified —
Microsoft Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1709 for x64-based Systems unspecified —
Microsoft Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1709 for ARM64-based Systems unspecified —
Microsoft Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1903 for 32-bit Systems unspecified —
Microsoft Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1903 for x64-based Systems unspecified —
Microsoft Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1903 for ARM64-based Systems unspecified —
Microsoft Microsoft Edge (EdgeHTML-based) on Windows 10 for 32-bit Systems unspecified —
Microsoft Microsoft Edge (EdgeHTML-based) on Windows 10 for x64-based Systems unspecified —
Microsoft Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1607 for 32-bit Systems unspecified —
Microsoft Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1607 for x64-based Systems unspecified —
Microsoft Microsoft Edge (EdgeHTML-based) on Windows Server 2016 unspecified —

Affected packages

EcosystemPackageAffectedFixedRecord
NuGet Microsoft.ChakraCore < 1.11.20 1.11.20 GHSA-g3m9-qrfj-xw4g

References