Microsoft · Microsoft Edge
A memory corruption flaw in the way the Chakra scripting engine handles objects in memory affects Microsoft Edge and ChakraCore. An attacker can achieve remote code execution by exploiting this flaw.
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2019-0567, CVE-2019-0568.
Public exploit code (Exploit-DB) appeared 10 days after disclosure. No confirmed exploitation is recorded.
4 related vulnerabilities in the same code over 22 months. The latest fix listed for Microsoft.ChakraCore is 1.11.6.
Why these are linked: Link confidenceHow strong the evidence is that two CVEs are related. High: stated in the CVE text or linked in an advisory, or the same code was patched one release apart. Medium: the same code, or a version step plus a similar description. Low: similar description only.
Why these are linked: Link confidenceHow strong the evidence is that two CVEs are related. High: stated in the CVE text or linked in an advisory, or the same code was patched one release apart. Medium: the same code, or a version step plus a similar description. Low: similar description only.
No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
1 package in 1 ecosystem. Main package: Microsoft.ChakraCore.
Upgrade to 1.11.11 or later
Fixes this CVE and 44 other known vulnerabilities in this package (CVE-2016-0191, CVE-2016-0193, +42).
Set the version to 1.11.11 or later in your .csproj.
First fixed in 1.11.5 for CVE-2019-0539.
| If you run | Upgrade to |
|---|---|
| All versions before 1.11.5 | 1.11.11first fix for this CVE: 1.11.5 |
“Up to” means the second version is the fix and is not affected.