CVE-2020-1073 - A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting Engine Memory Corruption Vulnerability'

Back Back to CVE browser

HIGH

A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting Engine Memory Corruption Vulnerability'

Published Jun 9, 2020

8.1

HIGH

CVSS 3.1

EPSS 8.64%

Description

A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting Engine Memory Corruption Vulnerability'.

Affected products

Vendor Microsoft Product ChakraCore Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  -
Vendor Microsoft Product Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1607 for 32-bit Systems Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  -
Vendor Microsoft Product Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1607 for x64-based Systems Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  -
Vendor Microsoft Product Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1709 for 32-bit Systems Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  -
Vendor Microsoft Product Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1709 for x64-based Systems Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  -
Vendor Microsoft Product Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1803 for 32-bit Systems Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  -
Vendor Microsoft Product Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1803 for x64-based Systems Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  -
Vendor Microsoft Product Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1809 for 32-bit Systems Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  -
Vendor Microsoft Product Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1809 for x64-based Systems Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  -
Vendor Microsoft Product Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1903 for 32-bit Systems Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  -
Vendor Microsoft Product Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1903 for x64-based Systems Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  -
Vendor Microsoft Product Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1909 for 32-bit Systems Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  -
Vendor Microsoft Product Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1909 for x64-based Systems Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  -
Vendor Microsoft Product Microsoft Edge (EdgeHTML-based) on Windows 10 for 32-bit Systems Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  -
Vendor Microsoft Product Microsoft Edge (EdgeHTML-based) on Windows 10 for x64-based Systems Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  -
Vendor Microsoft Product Microsoft Edge (EdgeHTML-based) on Windows Server 2016 Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  -
Vendor Microsoft Product Microsoft Edge (EdgeHTML-based) on Windows Server 2019 Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  -
Vendor Microsoft Product n/a Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Microsoft

ChakraCore

n/a

Version	Status	Constraints
unspecified	affected	-

Microsoft

Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1607 for 32-bit Systems

n/a

Version	Status	Constraints
unspecified	affected	-

Microsoft

Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1607 for x64-based Systems

n/a

Version	Status	Constraints
unspecified	affected	-

Microsoft

Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1709 for 32-bit Systems

n/a

Version	Status	Constraints
unspecified	affected	-

Microsoft

Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1709 for x64-based Systems

n/a

Version	Status	Constraints
unspecified	affected	-

Microsoft

Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1803 for 32-bit Systems

n/a

Version	Status	Constraints
unspecified	affected	-

Microsoft

Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1803 for x64-based Systems

n/a

Version	Status	Constraints
unspecified	affected	-

Microsoft

Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1809 for 32-bit Systems

n/a

Version	Status	Constraints
unspecified	affected	-

Microsoft

Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1809 for x64-based Systems

n/a

Version	Status	Constraints
unspecified	affected	-

Microsoft

Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1903 for 32-bit Systems

n/a

Version	Status	Constraints
unspecified	affected	-

Microsoft

Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1903 for x64-based Systems

n/a

Version	Status	Constraints
unspecified	affected	-

Microsoft

Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1909 for 32-bit Systems

n/a

Version	Status	Constraints
unspecified	affected	-

Microsoft

Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1909 for x64-based Systems

n/a

Version	Status	Constraints
unspecified	affected	-

Microsoft

Microsoft Edge (EdgeHTML-based) on Windows 10 for 32-bit Systems

n/a

Version	Status	Constraints
unspecified	affected	-

Microsoft

Microsoft Edge (EdgeHTML-based) on Windows 10 for x64-based Systems

n/a

Version	Status	Constraints
unspecified	affected	-

Microsoft

Microsoft Edge (EdgeHTML-based) on Windows Server 2016

n/a

Version	Status	Constraints
unspecified	affected	-

Microsoft

Microsoft Edge (EdgeHTML-based) on Windows Server 2019

n/a

Version	Status	Constraints
unspecified	affected	-

Microsoft

n/a

Version	Status	Constraints
unspecified	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-119

Buffer Overflow

CWE-787

Out-of-bounds Write

References (6)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-3875
Advisory
https://github.com/advisories/GHSA-g3m9-qrfj-xw4g
Advisory
https://github.com/chakra-core/ChakraCore/commit/82d3c4556a3cba13f0115fc98a91263b15fa6d07
https://github.com/chakra-core/ChakraCore/pull/6464
https://nvd.nist.gov/vuln/detail/CVE-2020-1073
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1073
x_refsource_MISCPatchVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-3875		Advisory
https://github.com/advisories/GHSA-g3m9-qrfj-xw4g		Advisory
https://github.com/chakra-core/ChakraCore/commit/82d3c4556a3cba13f0115fc98a91263b15fa6d07
https://github.com/chakra-core/ChakraCore/pull/6464
https://nvd.nist.gov/vuln/detail/CVE-2020-1073
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1073		x_refsource_MISCPatchVendor Advisory