CVE-2018-8380

Опубликовано: 15 авг. 2018

Источник: nvd

CVSS3: 7.5

CVSS2: 7.6

EPSS Низкий

Описание

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8266, CVE-2018-8381, CVE-2018-8384.

Ссылки

http://www.securityfocus.com/bid/104979
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1041457
Third Party Advisory
VDB Entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8380
Patch
Vendor Advisory
http://www.securityfocus.com/bid/104979
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1041457
Third Party Advisory
VDB Entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8380
Patch
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:microsoft:chakracore:*:*:*:*:*:*:*:*

Версия до 1.10.1 (включая)

Конфигурация 2

Одновременно

cpe:2.3:a:microsoft:edge:-:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_10:1803:*:*:*:*:*:*:*

EPSS

Процентиль: 92%

0.09094

Низкий

7.5 High

CVSS3

7.6 High

CVSS2

Дефекты

CWE-787

Связанные уязвимости

CVE-2018-8380

CVSS3: 4.2

msrc

около 7 лет назад

Chakra Scripting Engine Memory Corruption Vulnerability

GHSA-rxg4-vw2v-rxm4

CVSS3: 7.5

github

больше 3 лет назад

ChakraCore remote code execution vulnerability

BDU:2018-01014

CVSS3: 9.8

fstec