CVE-2018-8459 (High) detected in multiple libraries

[dev-mend-for-github-com]

CVE-2018-8459 - High Severity Vulnerability

Vulnerable Libraries - ChakraCore-1.8.1.0.dll, ChakraCore-1.8.1.0.dll, ChakraCore-1.8.1.0.dll, microsoft.chakracore.1.8.1.nupkg

ChakraCore-1.8.1.0.dll

Microsoft ? Chakra Core

Library home page: https://api.nuget.org/packages/microsoft.chakracore.1.8.1.nupkg

Path to vulnerable library: /SDK/bin/Debug/net5.0/runtimes/win8-arm/native/ChakraCore.dll,/SDK/bin/Debug/netcoreapp3.1/runtimes/win8-arm/native/ChakraCore.dll

Dependency Hierarchy:

• ❌ ChakraCore-1.8.1.0.dll (Vulnerable Library)

ChakraCore-1.8.1.0.dll

Microsoft ? Chakra Core

Library home page: https://api.nuget.org/packages/microsoft.chakracore.1.8.1.nupkg

Path to vulnerable library: /SDK/bin/Debug/netcoreapp3.1/runtimes/win7-x86/native/ChakraCore.dll,/SDK/bin/Debug/net5.0/runtimes/win7-x86/native/ChakraCore.dll

Dependency Hierarchy:

• ❌ ChakraCore-1.8.1.0.dll (Vulnerable Library)

ChakraCore-1.8.1.0.dll

Microsoft ? Chakra Core

Library home page: https://api.nuget.org/packages/microsoft.chakracore.1.8.1.nupkg

Path to vulnerable library: /SDK/bin/Debug/netcoreapp3.1/runtimes/win7-x64/native/ChakraCore.dll,/SDK/bin/Debug/net5.0/runtimes/win7-x64/native/ChakraCore.dll

Dependency Hierarchy:

• ❌ ChakraCore-1.8.1.0.dll (Vulnerable Library)

microsoft.chakracore.1.8.1.nupkg

ChakraCore is the core part of the Chakra Javascript engine that powers Microsoft Edge.

Library home page: https://api.nuget.org/packages/microsoft.chakracore.1.8.1.nupkg

Path to dependency file: /SDK/SDK.csproj

Path to vulnerable library: /crosoft.chakracore/1.8.1/microsoft.chakracore.1.8.1.nupkg

Dependency Hierarchy:

• ❌ microsoft.chakracore.1.8.1.nupkg (Vulnerable Library)

Found in HEAD commit: 2cdcbe42d2efe636b5e9b1d4c29c9da6e2c9b927

Found in base branch: master

Vulnerability Details

A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8354, CVE-2018-8391, CVE-2018-8456, CVE-2018-8457.

Publish Date: 2018-09-13

URL: CVE-2018-8459

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: chakra-core/ChakraCore#5688

Release Date: 2018-09-13

Fix Resolution: v1.11.1

---

⛑️ Automatic Remediation is available for this issue