Code

ChakraCore 2018-05 security updates#5116

Code

Merged

chakrabot merged 14 commits intochakra-core:release/1.8chakra-core/ChakraCore:release/1.8from MSLaguana:servicing/1805MSLaguana/ChakraCore:servicing/1805Copy head branch name to clipboardMay 8, 2018

+513-276

Commits

Commits on May 8, 2018

• [CVE-2018-0945] Chakra - Crashing on a null deref - Individual

  

  Meghana Gupta

  authored and

  MSLaguana

  committed
  87f3367

  Copy full SHA for 87f3367

• [CVE-2018-8139] Edge - Chakra type confusion in boundfunction handling - Internal

  MSLaguana

  committed
  ee5dfab

  Copy full SHA for ee5dfab

• [CVE-2018-8137] Edge - chakra JIT array out of bound read/write vulnerability lead to Remote Code Execution

  

  sigatrev

  authored and

  MSLaguana

  committed
  6e362fe

  Copy full SHA for 6e362fe

• [CVE-2018-8178] Edge - Incorrect entry point expiration can cause RCE - Internal

  Show description for c8f723d
  

  pleath

  authored and

  MSLaguana

  committed
  c8f723d

  Copy full SHA for c8f723d

• [CVE-2018-8128] Edge - UAF of borrowed inline caches after redeferral

  Show description for 23848b1
  

  pleath

  authored and

  MSLaguana

  committed
  23848b1

  Copy full SHA for 23848b1

• [CVE-2018-8177] Edge - Speculative type confusion on PropertyString

  Show description for eb4b00b
  

  sethbrenith

  authored and

  MSLaguana

  committed
  eb4b00b

  Copy full SHA for eb4b00b

• Add masking of stores for protection against Spectre.

  

  Penguinwizzard

  authored and

  MSLaguana

  committed
  e664e18

  Copy full SHA for e664e18

• [CVE-2018-8130] [CVE-2018-0946] move allocators to ServerScriptContext, add missing marshalling code

  

  MikeHolman

  authored and

  MSLaguana

  committed
  bee1e24

  Copy full SHA for bee1e24

• [CVE-2018-0953] Edge Chakra - JIT: Magic value can cause type confusion - Google, Inc.

  

  rajatd

  authored and

  MSLaguana

  committed
  71d7b38

  Copy full SHA for 71d7b38

• [CVE-2018-0943]: Chakra Bug 15964039 - Unrestored bytecode register after bailout

  

  rajatd

  authored and

  MSLaguana

  committed
  32ee5de

  Copy full SHA for 32ee5de

• [CVE-2018-8133] Edge - Chakra: Type confusion with EntrySimpleObjectSlotGetter

  

  akroshg

  authored and

  MSLaguana

  committed
  1b56f9f

  Copy full SHA for 1b56f9f

• [CVE-2018-1022] Inline segment is passed to another array - Internal

  

  akroshg

  authored and

  MSLaguana

  committed
  28928cb

  Copy full SHA for 28928cb

• [CVE-2018-0954] Report a stack variable uaf bug to Edge Bug Bounty - 360Vulcan - Edge RCE+Web Plat beta bounty on WIP

  

  agarwal-sandeep

  authored and

  MSLaguana

  committed
  51c4637

  Copy full SHA for 51c4637

• Bumping version prior to release

  MSLaguana

  committed
  ec2922b

  Copy full SHA for ec2922b