Remote Code Execution (RCE)

microsoft.chakracore is vulnerable to remote code execution. In inline.cpp, the Op_MaxInAnArray and Op_MinInAnArray functions are not prevented from calling user-defined javascript functions. This CVE ID is different from from CVE-2017-11886, CVE-2017-11889, CVE-2017-11890, CVE-2017-11894, CVE-2017-11895, CVE-2017-11901, CVE-2017-11903, CVE-2017-11905, CVE-2017-11907, CVE-2017-11908, CVE-2017-11909, CVE-2017-11910, CVE-2017-11911, CVE-2017-11912, CVE-2017-11913, CVE-2017-11914, CVE-2017-11916, CVE-2017-11918, and CVE-2017-11930. This vulnerability also affects Microsoft Edge in Windows 10 1511, 1607, 1703, 1709, and Windows Server 2016.