CVE-2020-1037

HIGH7.5EPSS 3.8%

ChakraCore Remote Code Execution Vulnerability

發布日:2022/5/24修改日:2024/2/16

描述

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge (HTML-based), aka 'Chakra Scripting Engine Memory Corruption Vulnerability'.

受影響套件(1)

NuGet/Microsoft.ChakraCorefrom 0, < 1.11.19

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	HIGH7.5	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

參考連結(5)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2020-1037
PATCHhttps://github.com/chakra-core/ChakraCore
WEBhttps://github.com/chakra-core/ChakraCore/commit/73ced029e6a06fcce9fd8c886dc73e5290f2ae69
WEBhttps://github.com/chakra-core/ChakraCore/pull/6447
WEBhttps://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1037