Remote Code Execution (RCE)

🗓️ 09 Jan 2019 02:32:58Reported by Veracode Vulnerability DatabaseType

veracode🔗 sca.analysiscenter.veracode.com👁 34 Views

Microsoft.ChakraCore vulnerable to remote code execution via type confusion allowing attacker to run arbitrary code in user context. Different from CVE-2019-0567, CVE-2019-0568

Reporter	Title	Published	Views	Family All 89
GithubExploit	Exploit for Out-of-bounds Write in Microsoft	14 Oct 202608:26	–	githubexploit
zdt	Microsoft Edge Chakra - JsBuiltInEngineInterfaceExtensionObject::InjectJsBuiltInLibraryCode	20 Jan 201900:00	–	zdt
zdt	Microsoft Edge Chakra - NewScObjectNoCtor or InitProto Type Confusion Exploit	20 Jan 201900:00	–	zdt
zdt	Microsoft Edge Chakra - InitClass Type Confusion Exploit	20 Jan 201900:00	–	zdt
zdt	Microsoft Edge Chakra 1.11.4 - Read Permission via Type Confusion	4 Mar 201900:00	–	zdt
Gitee	Exploit for Improper Restriction of Operations within the Bounds of a Memory Buffer in Microsoft	27 Jul 202503:47	–	gitee
BDU FSTEC	ChakraCore Microsoft Edge RCE	18 Jan 201900:00	–	bdu_fstec
BDU FSTEC	ChakraCore Microsoft Edge RCE	22 Jan 201900:00	–	bdu_fstec
BDU FSTEC	ChakraCore Microsoft Edge RCE	22 Jan 201900:00	–	bdu_fstec
Circl	CVE-2019-0539	9 Jan 201914:53	–	circl

Vulners

Node

microsoft.chakracore microsoft.chakracoreRange1.2.0–1.11.4csharp

microsoft.chakracore.vc140 microsoft.chakracore.vc140Range1.4.1–1.11.4csharp

Source	Link
portal	www.portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0539
github	www.github.com/Microsoft/ChakraCore/pull/5899
securityfocus	www.securityfocus.com/bid/106401
exploit-db	www.exploit-db.com/exploits/46203/
exploit-db	www.exploit-db.com/exploits/46204/
exploit-db	www.exploit-db.com/exploits/46485/
github	www.github.com/Microsoft/ChakraCore/wiki/Roadmap

15 May 2019 06:18Current

8High risk

Vulners AI Score8

CVSS 27.6

CVSS 37.5

EPSS0.82902