Microsoft · Edge
The Chakra JavaScript scripting engine in Microsoft Edge contains a memory corruption flaw in which out-of-bounds writes allow arbitrary code execution or denial of service. An remote attacker can exploit it by luring a user to a crafted web site, with no authentication required but user interaction needed.
The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-7201, CVE-2016-7202, CVE-2016-7203, CVE-2016-7208, CVE-2016-7240, CVE-2016-7242, and CVE-2016-7243.
First seen exploited 2 months after disclosure. Public exploit code (Exploit-DB) appeared 8 days after disclosure.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
Arbitrary code execution via memory corruption
allows remote attackers to execute arbitrary code
Memory corruption causes application denial of service
cause a denial of service (memory corruption)
CVE-specific rules are not available in this build. Search SigmaHQ ↗
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
1 package in 1 ecosystem. Main package: Microsoft.ChakraCore.
Upgrade to 1.11.11 or later
Fixes this CVE and 44 other known vulnerabilities in this package (CVE-2016-0191, CVE-2016-0193, +42).
Set the version to 1.11.11 or later in your .csproj.
First fixed in 1.2.2 for CVE-2016-7200.
| If you run | Upgrade to |
|---|---|
| All versions before 1.2.2 | 1.11.11first fix for this CVE: 1.2.2 |
“Up to” means the second version is the fix and is not affected.
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.