CVE-2017-11767: Buffer Overflow
First published: Thu Nov 02 2017(Updated: )
ChakraCore allows an attacker to gain the same user rights as the current user, due to the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability".
Credit: secure@microsoft.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| nuget/Microsoft.ChakraCore | <1.6.2 | 1.6.2 |
| Microsoft Chakra | ||
| ChakraCore |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2017-11767
- https://github.com/chakra-core/ChakraCore/pull/3727
- https://github.com/chakra-core/ChakraCore/pull/3727/commits/b3e3959d14814f42ee2197c504c322bcbe12347d
- https://web.archive.org/web/20210124103810/http://www.securityfocus.com/bid/100838
- https://web.archive.org/web/20211127230635/http://www.securitytracker.com/id/1039369
- https://github.com/chakra-core/ChakraCore/commit/b3e3959d14814f42ee2197c504c322bcbe12347d
- https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2017-11767
- https://github.com/advisories/GHSA-c79v-2rjq-965m (Advisory)
- http://www.securityfocus.com/bid/100838
- http://www.securitytracker.com/id/1039369
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11767
Frequently Asked Questions
What is the severity of CVE-2017-11767?
CVE-2017-11767 has been rated as critical due to its potential to allow an attacker to gain administrative rights.
How do I fix CVE-2017-11767?
To fix CVE-2017-11767, users should update to the latest version of Microsoft ChakraCore where the vulnerability has been addressed.
What types of attacks can CVE-2017-11767 facilitate?
CVE-2017-11767 can facilitate attacks that allow an attacker to execute arbitrary code with the same user rights as the logged-in user.
Which versions of ChakraCore are affected by CVE-2017-11767?
CVE-2017-11767 affects all versions of Microsoft ChakraCore prior to the security update that addresses the vulnerability.
Can CVE-2017-11767 be exploited remotely?
Yes, CVE-2017-11767 can potentially be exploited remotely if an attacker can convince the user to run malicious scripts.
- collector/github-advisory-latest
- alias/GHSA-c79v-2rjq-965m
- alias/CVE-2017-11767
- collector/github-advisory
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- agent/weakness
- agent/severity
- agent/author
- agent/references
- agent/description
- agent/event
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/tags
- collector/nvd-cve
- package-manager/nuget
- vendor/microsoft
- canonical/microsoft chakra
- canonical/chakracore