CVE-2016-3248 — Vulnerability in Microsoft.ChakraCore — CVE Details
HIGH
ChakraCore RCE Vulnerability
Published May 14, 2022Updated February 16, 2024Source: osv
Summary
The Microsoft (1) JScript 9, (2) VBScript, and (3) Chakra JavaScript engines, as used in Microsoft Internet Explorer 9 through 11, Microsoft Edge, and other products, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-3259.
Advisory Timeline
- First published May 14, 2022 (1612 days ago).
- Last revised February 16, 2024 — 643 days after initial publication.
Affected Packages (1)
Affects 1 ecosystem: nuget (1).
| Package | Ecosystem | Affected | Fixed In |
|---|---|---|---|
| Microsoft.ChakraCore | nuget | 1.2.0 | Range-based data available |
Vulnerability Classification
Common Weakness Enumeration (CWE) identifiers for this vulnerability type.
- CWE-119Buffer OverflowMITRE
CVSS Score Breakdown
What the CVSS (Common Vulnerability Scoring System) 8.8 score means for each attack dimension.
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://nvd.nist.gov/vuln/detail/CVE-2016-3248ADVISORY
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-084WEB
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-085WEB
- https://github.com/chakra-core/ChakraCorePACKAGE
- https://github.com/chakra-core/ChakraCore/wiki/RoadmapWEB
- https://web.archive.org/web/20210125172707/http://www.securityfocus.com/bid/91578WEB
- https://web.archive.org/web/20211202003833/http://www.securitytracker.com/id/1036283WEB
Frequently Asked Questions
- What is CVE-2016-3248?
- ChakraCore RCE Vulnerability This vulnerability has been assigned a severity rating of HIGH (CVSS score: 8.8/10).
- How do I check if my project is affected by CVE-2016-3248?
- CVE-2016-3248 affects Microsoft.ChakraCore. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2016-3248 and 200,000+ other known vulnerabilities.
Severity & Exploitability
CVSS Score
8.8
High exploitability or significant impact. Prioritize remediation within days.
Also Known As
GHSA-q6mv-8vh9-4ggj
Related CVEs
- CVE-2019-0993HIGH
Chakra Scripting Engine Out-of-bounds write
- CVE-2018-8624HIGH
ChakraCore Remote code execution Vulnerability
- CVE-2018-8381HIGH
ChakraCore RCE Vulnerability
- CVE-2019-0639HIGH
High severity vulnerability that affects Microsoft.ChakraCore
- CVE-2019-1139HIGH
Out-of-bounds write in Microsoft.ChakraCore
- CVE-2018-8542HIGH
ChakraCore RCE Vulnerability
- CVE-2019-0806HIGH
ChakraCore RCE Vulnerability
- CVE-2018-8557HIGH
ChakraCore RCE Vulnerability
Check if you're affected
Scan your dependencies to see if this vulnerability affects your projects.
Scan Your Dependencies