CVE-2017-11797
HIGHChakraCore < 1.7.2 - Information Disclosure via Memory Handling
Title source: manualDescription
ChakraCore allows an attacker to execute arbitrary code in the context of the current user, due to how the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-11792, CVE-2017-11793, CVE-2017-11796, CVE-2017-11798, CVE-2017-11799, CVE-2017-11800, CVE-2017-11801, CVE-2017-11802, CVE-2017-11804, CVE-2017-11805, CVE-2017-11806, CVE-2017-11807, CVE-2017-11808, CVE-2017-11809, CVE-2017-11810, CVE-2017-11811, CVE-2017-11812, and CVE-2017-11821.
References (2)
Core 2
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/101145
Patch, Vendor Advisory x_refsource_confirm
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11797
Scores
CVSS v3
7.5
EPSS
0.2611
EPSS Percentile
96.4%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Details
CWE
CWE-200
Status
published
Products (3)
microsoft/chakracore
< 1.7.2
Microsoft Corporation/ChakraCore
ChakraCore
nuget/Microsoft.ChakraCore
0 - 1.7.3NuGet
Published
Oct 13, 2017
Tracked Since
Feb 18, 2026