Vulnerabilities > CVE-2019-1138 - Out-of-bounds Write vulnerability in Microsoft Chakracore and Edge

CVSS 7.5 - HIGH

Attack vector

NETWORK

Attack complexity

HIGH

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

high complexity

microsoft

CWE-787

NVD

Published: 2019-09-11

Updated: 2020-08-24

Summary

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1217, CVE-2019-1237, CVE-2019-1298, CVE-2019-1300.

Vulnerable Configurations

Part	Description	Count
Application	Microsoft Microsoft Edge - Microsoft Chakracore - Microsoft Chakracore 1.2.0 Microsoft Chakracore 1.2.0.0 Microsoft Chakracore 1.2.1 Microsoft Chakracore 1.2.2 Microsoft Chakracore 1.2.3 Microsoft Chakracore 1.3.0 Microsoft Chakracore 1.3.1 Microsoft Chakracore 1.3.2 Microsoft Chakracore 1.4.0 Microsoft Chakracore 1.4.1 Microsoft Chakracore 1.4.2 Microsoft Chakracore 1.4.3 Microsoft Chakracore 1.4.4 Microsoft Chakracore 1.4.5 Microsoft Chakracore 1.5.0 Microsoft Chakracore 1.5.1 Microsoft Chakracore 1.5.2 Microsoft Chakracore 1.5.3 Microsoft Chakracore 1.6.0 Microsoft Chakracore 1.6.1 Microsoft Chakracore 1.6.2 Microsoft Chakracore 1.7.0 Microsoft Chakracore 1.7.1 Microsoft Chakracore 1.7.2 Microsoft Chakracore 1.7.3 Microsoft Chakracore 1.7.4 Microsoft Chakracore 1.7.5 Microsoft Chakracore 1.7.6 Microsoft Chakracore 1.8.0 Microsoft Chakracore 1.8.1 Microsoft Chakracore 1.8.2 Microsoft Chakracore 1.8.3 Microsoft Chakracore 1.8.4 Microsoft Chakracore 1.8.5 Microsoft Chakracore 1.10.0 Microsoft Chakracore 1.10.1 Microsoft Chakracore 1.10.2 Microsoft Chakracore 1.11.0 Microsoft Chakracore 1.11.1 Microsoft Chakracore 1.11.2 Microsoft Chakracore 1.11.3 Microsoft Chakracore 1.11.4 Microsoft Chakracore 1.11.5 Microsoft Chakracore 1.11.6 Microsoft Chakracore 1.11.7 Microsoft Chakracore 1.11.8 Microsoft Chakracore 1.11.9 Microsoft Chakracore 1.11.10 Microsoft Chakracore 1.11.11 Microsoft Chakracore 1.11.12	52
OS	Microsoft Microsoft Windows 10 1607 Microsoft Windows 10 1703 Microsoft Windows 10 1709 Microsoft Windows 10 1803 Microsoft Windows 10 1809 Microsoft Windows 10 1903 Microsoft Windows Server 2016 - Microsoft Windows Server 2019 -	8

Common Weakness Enumeration (CWE)

CWE-787 - Out-of-bounds Write

References

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1138