vulnwire
7.5high

CVE-2016-3202in critical feed

ChakraCore RCE Vulnerability

Also known as GHSA-ww6f-76ff-phhj

Published 10 y ago · modified 4 mo ago · JSON

CVSS
7.5
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
17.4%
percentile 97%
Public exploits
0
none known

The Microsoft (1) Chakra JavaScript, (2) JScript, and (3) VBScript engines, as used in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability."

Exploit prediction (EPSS)

17.35% probability of exploitation in the next 30 days, higher than 97% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.07.5CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD2.07.6AV:N/AC:H/Au:N/C:C/I:C/A:C
GitHub3.07.5CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected packages

EcosystemPackageAffectedFixed in
nugetMicrosoft.ChakraCore
<1.2.0.0
1.2.0.0

Classification

Weakness
  • CWE-20 Improper Input Validation
  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

References

  • docs.microsoft.com /en-us/security-updates/securitybulletins/2016/ms16-063 · vendor-advisory, x_refsource_MS, x_transferred
  • securitytracker.com /id/1036099 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • securitytracker.com /id/1036096 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • docs.microsoft.com /en-us/security-updates/securitybulletins/2016/ms16-068 · vendor-advisory, x_refsource_MS, x_transferred
  • nvd.nist.gov /vuln/detail/CVE-2016-3202 · advisory
  • github.com /chakra-core/ChakraCore/commit/ff9067ebe9e1c92eff4e25da95070bfd5942da07 · web
  • github.com /chakra-core/ChakraCore · package
  • web.archive.org /web/20211129115034/http://www.securitytracker.com/id/1036099 · web
  • web.archive.org /web/20211208124350/http://www.securitytracker.com/id/1036096 · web

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.