vulnwire
7.5high

CVE-2018-8380in critical feed

ChakraCore remote code execution vulnerability

Also known as GHSA-rxg4-vw2v-rxm4

Published 8 y ago · modified 4 mo ago · JSON

CVSS
7.5
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
15.4%
percentile 97%
Public exploits
0
none known

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8266, CVE-2018-8381, CVE-2018-8384.

Exploit prediction (EPSS)

15.38% probability of exploitation in the next 30 days, higher than 97% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.07.5CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD2.07.6AV:N/AC:H/Au:N/C:C/I:C/A:C
GitHub3.07.5CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected packages

EcosystemPackageAffectedFixed in
nugetMicrosoft.ChakraCore
<1.10.2
1.10.2

Affected products

  • Microsoft Microsoft Edge
  • Microsoft ChakraCore

Classification

Weakness

References

  • portal.msrc.microsoft.com /en-US/security-guidance/advisory/CVE-2018-8380 · x_refsource_CONFIRM, x_transferred
  • securitytracker.com /id/1041457 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • securityfocus.com /bid/104979 · vdb-entry, x_refsource_BID, x_transferred
  • nvd.nist.gov /vuln/detail/CVE-2018-8380 · advisory
  • github.com /chakra-core/ChakraCore/pull/5596 · web
  • github.com /chakra-core/ChakraCore/commit/15bd39993cff2bdef0d2bd46751bb7375b3592b3 · web
  • github.com /Microsoft/ChakraCore/wiki/Roadmap#v1102 · web
  • web.archive.org /web/20210125211937/http://www.securityfocus.com/bid/104979 · web
  • web.archive.org /web/20211203061111/http://www.securitytracker.com/id/1041457 · web

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.