Lucene search

MicrosoftCVE-2017-11767

HistoryNov 02, 2017 - 7:29 p.m.

CVE-2017-11767

2017-11-0219:29:00

CWE-119

microsoft

web.nvd.nist.gov

cve-2017-11767

chakracore

memory corruption

scripting engine

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.2

Confidence

High

EPSS

0.008

Percentile

81.4%

JSON

ChakraCore allows an attacker to gain the same user rights as the current user, due to the way that the ChakraCore scripting engine handles objects in memory, aka “Scripting Engine Memory Corruption Vulnerability”.

Affected configurations

Nvd

Vulners

Node

microsoftchakracoreMatch-

VendorProductVersionCPE
microsoftchakracore-cpe:2.3:a:microsoft:chakracore:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
microsoft	chakracore	-	cpe:2.3:a:microsoft:chakracore:-:::::::*

CNA Affected

[
  {
    "product": "ChakraCore",
    "vendor": "Microsoft Corporation",
    "versions": [
      {
        "status": "affected",
        "version": "ChakraCore"
      }
    ]
  }
]

References

www.securityfocus.com/bid/100838

www.securitytracker.com/id/1039369

portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11767

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.2

Confidence

High

EPSS

0.008

Percentile

81.4%

JSON

Related for CVE-2017-11767