CVE-2016-3296 — Vulnerability in Microsoft.ChakraCore — CVE Details
HIGH
ChakraCore RCE Vulnerability
Published May 14, 2022Updated February 16, 2024Source: osv
Summary
The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability."
Advisory Timeline
- First published May 14, 2022 (1612 days ago).
- Last revised February 16, 2024 — 643 days after initial publication.
Affected Packages (1)
Affects 1 ecosystem: nuget (1).
| Package | Ecosystem | Affected | Fixed In |
|---|---|---|---|
| Microsoft.ChakraCore | nuget | 1.2.0 | Range-based data available |
Vulnerability Classification
Common Weakness Enumeration (CWE) identifiers for this vulnerability type.
- CWE-119Buffer OverflowMITRE
CVSS Score Breakdown
What the CVSS (Common Vulnerability Scoring System) 7.5 score means for each attack dimension.
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://nvd.nist.gov/vuln/detail/CVE-2016-3296ADVISORY
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-096WEB
- https://github.com/chakra-core/ChakraCorePACKAGE
- https://github.com/chakra-core/ChakraCore/wiki/RoadmapWEB
- https://web.archive.org/web/20210116095719/http://www.securitytracker.com/id/1036569WEB
- https://web.archive.org/web/20210123160236/http://www.securityfocus.com/bid/92283WEB
Frequently Asked Questions
- What is CVE-2016-3296?
- ChakraCore RCE Vulnerability This vulnerability has been assigned a severity rating of HIGH (CVSS score: 7.5/10).
- How do I check if my project is affected by CVE-2016-3296?
- CVE-2016-3296 affects Microsoft.ChakraCore. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2016-3296 and 200,000+ other known vulnerabilities.
Severity & Exploitability
CVSS Score
7.5
High exploitability or significant impact. Prioritize remediation within days.
Also Known As
GHSA-5ppx-g65v-4vfv
Related CVEs
- CVE-2017-11767CRITICAL
ChakraCore vulnerable to privilege escalation
- CVE-2019-0993HIGH
Chakra Scripting Engine Out-of-bounds write
- CVE-2018-8624HIGH
ChakraCore Remote code execution Vulnerability
- CVE-2019-0639HIGH
High severity vulnerability that affects Microsoft.ChakraCore
- CVE-2017-11893HIGH
ChakraCore vulnerable to remote code execution
- CVE-2019-0806HIGH
ChakraCore RCE Vulnerability
- CVE-2018-8557HIGH
ChakraCore RCE Vulnerability
- CVE-2017-11821HIGH
ChakraCore RCE Vulnerability
Check if you're affected
Scan your dependencies to see if this vulnerability affects your projects.
Scan Your Dependencies