CVE-2019-1298
published 2019-09-11CVE-2019-1298: A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting…
PriorityP345high7.5CVSS 3.1
AVNACHPRNUIRSUCHIHAH
EPSS
8.67%
94.5th percentile
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1138, CVE-2019-1217, CVE-2019-1237, CVE-2019-1300.
Affected
41 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | chakracore | < 1.11.13 | 1.11.13 |
| microsoft | chakracore | — | — |
| microsoft | microsoft_edge_on_windows_10_for_32-bit_systems | — | — |
| microsoft | microsoft_edge_on_windows_10_for_x64-based_systems | — | — |
| microsoft | microsoft_edge_on_windows_10_version_1607_for_32-bit_systems | — | — |
| microsoft | microsoft_edge_on_windows_10_version_1607_for_x64-based_systems | — | — |
| microsoft | microsoft_edge_on_windows_10_version_1703_for_32-bit_systems | — | — |
| microsoft | microsoft_edge_on_windows_10_version_1703_for_x64-based_systems | — | — |
| microsoft | microsoft_edge_on_windows_10_version_1709_for_32-bit_systems | — | — |
| microsoft | microsoft_edge_on_windows_10_version_1709_for_arm64-based_systems | — | — |
| microsoft | microsoft_edge_on_windows_10_version_1709_for_x64-based_systems | — | — |
| microsoft | microsoft_edge_on_windows_10_version_1803_for_32-bit_systems | — | — |
| microsoft | microsoft_edge_on_windows_10_version_1803_for_arm64-based_systems | — | — |
| microsoft | microsoft_edge_on_windows_10_version_1803_for_x64-based_systems | — | — |
| microsoft | microsoft_edge_on_windows_10_version_1809_for_32-bit_systems | — | — |
| microsoft | microsoft_edge_on_windows_10_version_1809_for_arm64-based_systems | — | — |
| microsoft | microsoft_edge_on_windows_10_version_1809_for_x64-based_systems | — | — |
| microsoft | microsoft_edge_on_windows_10_version_1903_for_32-bit_systems | — | — |
| microsoft | microsoft_edge_on_windows_10_version_1903_for_arm64-based_systems | — | — |
| microsoft | microsoft_edge_on_windows_10_version_1903_for_x64-based_systems | — | — |
| microsoft | microsoft_edge_on_windows_server_2016 | — | — |
| microsoft | microsoft_edge_on_windows_server_2019 | — | — |
| msrc | chakracore | — | — |
| msrc | microsoft_edge_on_windows_10_version_1607_for_32-bit_systems | — | — |
| msrc | microsoft_edge_on_windows_10_version_1607_for_x64-based_systems | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.07.6HIGHAV:N/AC:H/Au:N/C:C/I:C/A:C
ghsa7.5HIGH
osv7.5HIGH
vendor_msrc4.2MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Out-of-bounds write
osv·2021-03-29·CVSS 7.5
CVE-2019-1300 [HIGH] Out-of-bounds write
Out-of-bounds write
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1138, CVE-2019-1217, CVE-2019-1237, CVE-2019-1298.
OSV
Out-of-bounds write
osv·2021-03-29·CVSS 7.5
CVE-2019-1217 [HIGH] Out-of-bounds write
Out-of-bounds write
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1138, CVE-2019-1237, CVE-2019-1298, CVE-2019-1300.
GHSA
Out-of-bounds write
ghsa·2021-03-29·CVSS 7.5
CVE-2019-1298 [HIGH] CWE-787 Out-of-bounds write
Out-of-bounds write
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1138, CVE-2019-1217, CVE-2019-1237, CVE-2019-1300.
OSV
Out-of-bounds write
osv·2021-03-29·CVSS 7.5
CVE-2019-1237 [HIGH] Out-of-bounds write
Out-of-bounds write
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1138, CVE-2019-1217, CVE-2019-1298, CVE-2019-1300.
GHSA
Out-of-bounds write
ghsa·2021-03-29·CVSS 7.5
CVE-2019-1237 [HIGH] CWE-787 Out-of-bounds write
Out-of-bounds write
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1138, CVE-2019-1217, CVE-2019-1298, CVE-2019-1300.
GHSA
Out-of-bounds write
ghsa·2021-03-29·CVSS 7.5
CVE-2019-1217 [HIGH] CWE-787 Out-of-bounds write
Out-of-bounds write
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1138, CVE-2019-1237, CVE-2019-1298, CVE-2019-1300.
GHSA
Out-of-bounds write
ghsa·2021-03-29·CVSS 7.5
CVE-2019-1300 [HIGH] CWE-787 Out-of-bounds write
Out-of-bounds write
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1138, CVE-2019-1217, CVE-2019-1237, CVE-2019-1298.
OSV
Out-of-bounds write
osv·2021-03-29·CVSS 7.5
CVE-2019-1298 [HIGH] Out-of-bounds write
Out-of-bounds write
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1138, CVE-2019-1217, CVE-2019-1237, CVE-2019-1300.
GHSA
Out-of-bounds write
ghsa·2021-03-29·CVSS 7.5
CVE-2019-1138 [HIGH] CWE-787 Out-of-bounds write
Out-of-bounds write
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1217, CVE-2019-1237, CVE-2019-1298, CVE-2019-1300.
OSV
Out-of-bounds write
osv·2021-03-29·CVSS 7.5
CVE-2019-1138 [HIGH] Out-of-bounds write
Out-of-bounds write
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1217, CVE-2019-1237, CVE-2019-1298, CVE-2019-1300.
Microsoft
Chakra Scripting Engine Memory Corruption Vulnerability
vendor_msrc·2019-09-10·CVSS 4.2
CVE-2019-1298 [HIGH] Chakra Scripting Engine Memory Corruption Vulnerability
Chakra Scripting Engine Memory Corruption Vulnerability
Description: A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge (HTML-based). The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
In a web-based attack scenario, an attacker could host a
No detection rules found.
No public exploits indexed.
Trendmicro
September Patch Tuesday: RDP Vulns and Zero-Days
blogs_trendmicro·2019-09-11·CVSS 8.8
[HIGH] September Patch Tuesday: RDP Vulns and Zero-Days
Exploits & Vulnerabilities
# September Patch Tuesday: RDP Vulns and Zero-Days
Microsoft’s September Patch Tuesday covered a total of 80 CVEs, 17 of which were rated critical.
By: Trend Micro
2019/09/11
Read time: ( words)
Save to Folio
Microsoft’s September Patch Tuesday covered 80 CVEs, 17 of which were rated critical, and included patches for Azure DevOps Server, Chakra Scripting engine, and Microsoft SharePoint. Sixty-two were labeled as important and included patches for Microsoft Excel, Microsoft Edge, and Microsoft Exchange. Only one was rated as moderate.
### Remote desktop vulnerabilities
Continuing the trend from last month, several of the critical patches were for Remote Desktop Clients and are CVE-2019-0787, CVE-2019-0788, CVE-2019-1290, and CVE-2019-1291 — all Remote Co
Trendmicro
September Patch Tuesday: RDP Vulns and Zero-Days
blogs_trendmicro·2019-09-11·CVSS 8.8
[HIGH] September Patch Tuesday: RDP Vulns and Zero-Days
# September Patch Tuesday: RDP Vulns and Zero-Days
Microsoft’s September Patch Tuesday covered a total of 80 CVEs, 17 of which were rated critical.
By: Trend Micro
Sep 11, 2019
Read time: ( words)
Save to Folio
Microsoft’s September Patch Tuesday covered 80 CVEs, 17 of which were rated critical, and included patches for Azure DevOps Server, Chakra Scripting engine, and Microsoft SharePoint. Sixty-two were labeled as important and included patches for Microsoft Excel, Microsoft Edge, and Microsoft Exchange. Only one was rated as moderate.
### Remote desktop vulnerabilities
Continuing the trend from last month, several of the critical patches were for Remote Desktop Clients and are CVE-2019-0787, CVE-2019-0788, CVE-2019-1290, and CVE-2019-1291 — all Remote Code Execution (RCE) vulnera
2019-09-11
Published