CVE-2016-7208

The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted web site, aka “Scripting Engine Memory Corruption Vulnerability,” a different vulnerability than CVE-2016-7200, CVE-2016-7201,...

CVE-2016-7201

The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted web site, aka “Scripting Engine Memory Corruption Vulnerability,” a different vulnerability than CVE-2016-7200, CVE-2016-7202,...

CVE-2016-7202

The scripting engines in Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted web site, aka “Scripting Engine Memory Corruption Vulnerability,” as demonstrated by the Chakra...

CVE-2016-7200

The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted web site, aka “Scripting Engine Memory Corruption Vulnerability,” a different vulnerability than CVE-2016-7201, CVE-2016-7202,...

CVE-2016-7243

The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted web site, aka “Scripting Engine Memory Corruption Vulnerability,” a different vulnerability than CVE-2016-7200, CVE-2016-7201,...

PT-2016-2972 · Microsoft · Chakra Javascript Engine +3

Name of the Vulnerable Software and Affected Versions: Microsoft Edge affected versions not specified Microsoft Internet Explorer affected versions not specified Microsoft Windows affected versions not specified Description: The issue is caused by a buffer overflow in the Chakra JavaScript engine...

PT-2016-2925 · Microsoft · Chakra Javascript Engine +1

Name of the Vulnerable Software and Affected Versions: Microsoft Edge affected versions not specified Description: The issue is caused by a buffer overflow in the Chakra JavaScript engine of Microsoft Edge, allowing a remote attacker to execute arbitrary code or cause a denial of service memory...

PT-2016-2974 · Microsoft · Edge

Name of the Vulnerable Software and Affected Versions: Microsoft Edge affected versions not specified Description: The issue is related to a memory corruption vulnerability in Microsoft Edge, specifically in the Chakra JavaScript engine, caused by a buffer overflow. This could allow a remote...

PT-2016-2928 · Microsoft · Chakra Javascript Engine +1

Name of the Vulnerable Software and Affected Versions: Microsoft Edge affected versions not specified Description: The issue is caused by a buffer overflow in the Chakra JavaScript engine of Microsoft Edge, allowing a remote attacker to execute arbitrary code or cause a denial of service memory...

PT-2016-2926 · Microsoft · Chakra Javascript Engine +1

Name of the Vulnerable Software and Affected Versions: Microsoft Edge affected versions not specified Description: The issue is caused by a buffer overflow in the Chakra JavaScript engine of Microsoft Edge, allowing a remote attacker to execute arbitrary code or cause a denial of service memory...

Microsoft Edge Scripting Engine Memory Corruption (MS16-129: CVE-2016-7240)

A memory corruption vulnerability exists in Microsoft Edge. The vulnerability is due to the way Chakra JavaScript engine renders when handling objects in memory. A remote unauthenticated attacker could exploit this vulnerability by enticing the target user to open a specially crafted web page...

PT-2016-2973 · Microsoft · Chakra Javascript Engine +1

Name of the Vulnerable Software and Affected Versions: Microsoft Edge affected versions not specified Description: The issue is caused by a buffer overflow in the Chakra JavaScript engine of Microsoft Edge, allowing a remote attacker to execute arbitrary code or cause a denial of service memory...

Microsoft Edge - Spread Operator Stack Overflow (MS16-119)

Microsoft Edge - Spread Operator Stack Overflow MS16-119 GetLength destArgs.Info.Count AssertMsgfalse, "The array length has changed since we allocated the destArgs buffer?"; Throw::FatalInternalError; for uint32 j = 0; j GetLength; j++ Var element; if !arr-DirectGetItemAtFullj, &element element ...

Microsoft Edge - Array.map Heap Overflow (MS16-119)

Microsoft Edge - Array.map Heap Overflow MS16-119 var b = new Array1,2,3; var d = new Array1,2,3; class dummy constructor alert"in constructor"; return d; var handler = get: functiontarget, name ifname == "length" return 0x100; return Symbol.species : dummy; , has: functiontarget, name alert"has ...

Microsoft Edge - Function.apply Information Leak (MS16-119)

Microsoft Edge - Function.apply Information Leak MS16-119 var t = new Array1,2,3; function f var h = ; var a = ...arguments foritem in a var n = new Numberaitem; if n 0 n = n + 0x100000000; h.pushn.toString16; alerth; var q = f; t.length = 20; var o =...

Microsoft Edge - 'Function.apply' Information Leak (MS16-119)

var t = new Array1,2,3; function f var h = ; var a = ...arguments foritem in a var n = new Numberaitem; if n 0 n = n + 0x100000000; h.pushn.toString16; alerth; var q = f; t.length = 20; var o = ; Object.definePropertyo, '3', get: function...

Microsoft Edge - Spread Operator Stack Overflow (MS16-119)

GetLength destArgs.Info.Count AssertMsgfalse, "The array length has changed since we allocated the destArgs buffer?"; Throw::FatalInternalError; for uint32 j = 0; j GetLength; j++ Var element; if !arr-DirectGetItemAtFullj, &element element = undefined; destArgs.ValuesargsIndex++ = element; When...

Microsoft Edge - Array.join Infomation Leak (MS16-119)

Microsoft Edge - Array.join Infomation Leak MS16-119 var y = 0; var t = new Array1,2,3; t.length = 100; var o = ; Object.definePropertyo, '3', get: function alert'get!'; t0 = ; var j = ; forvar i = 0; i 100; i++ ti = a : i;...

Microsoft Edge - 'Array.map' Heap Overflow (MS16-119)

var b = new Array1,2,3; var d = new Array1,2,3; class dummy constructor alert"in constructor"; return d; var handler = get: functiontarget, name ifname == "length" return 0x100; return Symbol.species : dummy; , has: functiontarget, name alert"has " + name; return true; ; var p = new Proxy, handle...

Microsoft Edge - 'Array.join' Infomation Leak (MS16-119)

var y = 0; var t = new Array1,2,3; t.length = 100; var o = ; Object.definePropertyo, '3', get: function alert'get!'; t0 = ; var j = ; forvar i = 0; i 100; i++ ti = a : i; return 7; ; t.proto = o; var...