7.5Alta
KEV
CVE-2018-8298ChakraCore Scripting Engine Type Confusion Vulnerability
Explotación conocida — ChakraCore Scripting Engine Type Confusion Vulnerability
CISA confirmó el 03.03.2022 que esta vulnerabilidad se usa en ataques reales. Plazo para las agencias federales de EE. UU.: 17.03.2022.
Acción requerida: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2018-8298
Descripción
A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability." This affects ChakraCore. This CVE ID is unique from CVE-2018-8242, CVE-2018-8283, CVE-2018-8287, CVE-2018-8288, CVE-2018-8291, CVE-2018-8296.
Debilidad (CWE):
CWE-843
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| Microsoft | ChakraCore | ChakraCore |
Referencias y parches
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8298 PatchVendor Advisory
- 104639 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
- 45217 exploitExploitThird Party AdvisoryVDB Entry
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-8298 US Government Resource
Coincidencias CPE (NVD) (1)
cpe:2.3:a:microsoft:chakracore:*:*:*:*:*:*:*:*< 1.10.1