CVE-2018-8500 (High) detected in multiple libraries

[dev-mend-for-github-com]

CVE-2018-8500 - High Severity Vulnerability

Vulnerable Libraries - ChakraCore-1.8.1.0.dll, microsoft.chakracore.1.8.1.nupkg, ChakraCore-1.8.1.0.dll, ChakraCore-1.8.1.0.dll

ChakraCore-1.8.1.0.dll

Microsoft ? Chakra Core

Library home page: https://api.nuget.org/packages/microsoft.chakracore.1.8.1.nupkg

Path to vulnerable library: /SDK/bin/Debug/net5.0/runtimes/win8-arm/native/ChakraCore.dll,/SDK/bin/Debug/netcoreapp3.1/runtimes/win8-arm/native/ChakraCore.dll

Dependency Hierarchy:

• ❌ ChakraCore-1.8.1.0.dll (Vulnerable Library)

microsoft.chakracore.1.8.1.nupkg

ChakraCore is the core part of the Chakra Javascript engine that powers Microsoft Edge.

Library home page: https://api.nuget.org/packages/microsoft.chakracore.1.8.1.nupkg

Path to dependency file: /SDK/SDK.csproj

Path to vulnerable library: /crosoft.chakracore/1.8.1/microsoft.chakracore.1.8.1.nupkg

Dependency Hierarchy:

• ❌ microsoft.chakracore.1.8.1.nupkg (Vulnerable Library)

ChakraCore-1.8.1.0.dll

Microsoft ? Chakra Core

Library home page: https://api.nuget.org/packages/microsoft.chakracore.1.8.1.nupkg

Path to vulnerable library: /SDK/bin/Debug/netcoreapp3.1/runtimes/win7-x64/native/ChakraCore.dll,/SDK/bin/Debug/net5.0/runtimes/win7-x64/native/ChakraCore.dll

Dependency Hierarchy:

• ❌ ChakraCore-1.8.1.0.dll (Vulnerable Library)

ChakraCore-1.8.1.0.dll

Microsoft ? Chakra Core

Library home page: https://api.nuget.org/packages/microsoft.chakracore.1.8.1.nupkg

Path to vulnerable library: /SDK/bin/Debug/netcoreapp3.1/runtimes/win7-x86/native/ChakraCore.dll,/SDK/bin/Debug/net5.0/runtimes/win7-x86/native/ChakraCore.dll

Dependency Hierarchy:

• ❌ ChakraCore-1.8.1.0.dll (Vulnerable Library)

Found in HEAD commit: 2cdcbe42d2efe636b5e9b1d4c29c9da6e2c9b927

Found in base branch: master

Vulnerability Details

A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability." This affects ChakraCore.

Publish Date: 2018-10-10

URL: CVE-2018-8500

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: chakra-core/ChakraCore#5764

Release Date: 2018-10-10

Fix Resolution: v1.11.2

---

⛑️ Automatic Remediation is available for this issue