cnvd - cnvd-2019-27382

cnvd-2019-27382

Vulnerability from cnvd

Title: Microsoft Edge缓冲区溢出漏洞（CNVD-2019-27382）

Description:

Microsoft ChakraCore和Microsoft Edge都是美国微软（Microsoft）公司的产品。ChakraCore是使用在Edge浏览器中的一个开源的ChakraJavaScript脚本引擎的核心部分，也可作为单独的JavaScript引擎使用。Microsoft Edge是一款Windows 10之后版本系统附带的Web浏览器。

Microsoft Edge和ChakraCore中存在缓冲区溢出漏洞。攻击者可利用该漏洞在当前用户的上下文中执行任意代码，造成内存损坏。

Severity: 高

Patch Name: Microsoft Edge缓冲区溢出漏洞（CNVD-2019-27382）的补丁

Patch Description:

Microsoft Edge和ChakraCore中存在缓冲区溢出漏洞。攻击者可利用该漏洞在当前用户的上下文中执行任意代码，造成内存损坏。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

目前厂商已发布升级补丁以修复漏洞，补丁获取链接：https://portal.msrc.microsoft.com/zh-CN/security-guidance/advisory/CVE-2019-0644

Reference: https://portal.msrc.microsoft.com/zh-CN/security-guidance/advisory/CVE-2019-0644

Impacted products

Name
Microsoft Edge

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2019-0644",
      "cveUrl": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0644"
    }
  },
  "description": "Microsoft ChakraCore\u548cMicrosoft Edge\u90fd\u662f\u7f8e\u56fd\u5fae\u8f6f\uff08Microsoft\uff09\u516c\u53f8\u7684\u4ea7\u54c1\u3002ChakraCore\u662f\u4f7f\u7528\u5728Edge\u6d4f\u89c8\u5668\u4e2d\u7684\u4e00\u4e2a\u5f00\u6e90\u7684ChakraJavaScript\u811a\u672c\u5f15\u64ce\u7684\u6838\u5fc3\u90e8\u5206\uff0c\u4e5f\u53ef\u4f5c\u4e3a\u5355\u72ec\u7684JavaScript\u5f15\u64ce\u4f7f\u7528\u3002Microsoft Edge\u662f\u4e00\u6b3eWindows 10\u4e4b\u540e\u7248\u672c\u7cfb\u7edf\u9644\u5e26\u7684Web\u6d4f\u89c8\u5668\u3002\n\nMicrosoft Edge\u548cChakraCore\u4e2d\u5b58\u5728\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5728\u5f53\u524d\u7528\u6237\u7684\u4e0a\u4e0b\u6587\u4e2d\u6267\u884c\u4efb\u610f\u4ee3\u7801\uff0c\u9020\u6210\u5185\u5b58\u635f\u574f\u3002",
  "discovererName": "Microsoft",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1ahttps://portal.msrc.microsoft.com/zh-CN/security-guidance/advisory/CVE-2019-0644",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2019-27382",
  "openTime": "2019-08-13",
  "patchDescription": "Microsoft ChakraCore\u548cMicrosoft Edge\u90fd\u662f\u7f8e\u56fd\u5fae\u8f6f\uff08Microsoft\uff09\u516c\u53f8\u7684\u4ea7\u54c1\u3002ChakraCore\u662f\u4f7f\u7528\u5728Edge\u6d4f\u89c8\u5668\u4e2d\u7684\u4e00\u4e2a\u5f00\u6e90\u7684ChakraJavaScript\u811a\u672c\u5f15\u64ce\u7684\u6838\u5fc3\u90e8\u5206\uff0c\u4e5f\u53ef\u4f5c\u4e3a\u5355\u72ec\u7684JavaScript\u5f15\u64ce\u4f7f\u7528\u3002Microsoft Edge\u662f\u4e00\u6b3eWindows 10\u4e4b\u540e\u7248\u672c\u7cfb\u7edf\u9644\u5e26\u7684Web\u6d4f\u89c8\u5668\u3002\r\n\r\nMicrosoft Edge\u548cChakraCore\u4e2d\u5b58\u5728\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5728\u5f53\u524d\u7528\u6237\u7684\u4e0a\u4e0b\u6587\u4e2d\u6267\u884c\u4efb\u610f\u4ee3\u7801\uff0c\u9020\u6210\u5185\u5b58\u635f\u574f\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Microsoft Edge\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\uff08CNVD-2019-27382\uff09\u7684\u8865\u4e01",
  "products": {
    "product": "Microsoft Edge"
  },
  "referenceLink": "https://portal.msrc.microsoft.com/zh-CN/security-guidance/advisory/CVE-2019-0644",
  "serverity": "\u9ad8",
  "submitTime": "2019-02-14",
  "title": "Microsoft Edge\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\uff08CNVD-2019-27382\uff09"
}

CVE-2019-0644 (GCVE-0-2019-0644)

Vulnerability from cvelistv5

Published

2019-03-06 00:00

Modified

2024-08-04 17:51

Severity ?

CWE

Remote Code Execution

Summary

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0590, CVE-2019-0591, CVE-2019-0593, CVE-2019-0605, CVE-2019-0607, CVE-2019-0610, CVE-2019-0640, CVE-2019-0642, CVE-2019-0651, CVE-2019-0652, CVE-2019-0655.

References

▼	URL	Tags
	http://www.securityfocus.com/bid/106889	vdb-entry, x_refsource_BID
	https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0644	x_refsource_CONFIRM

Impacted products

Vendor

Product

Version

▼

Microsoft

Microsoft Edge

Version: Windows Server 2016
Version: Windows 10 Version 1607 for 32-bit Systems
Version: Windows 10 Version 1607 for x64-based Systems
Version: Windows 10 Version 1703 for 32-bit Systems
Version: Windows 10 Version 1703 for x64-based Systems
Version: Windows 10 Version 1709 for 32-bit Systems
Version: Windows 10 Version 1709 for x64-based Systems
Version: Windows 10 Version 1803 for 32-bit Systems
Version: Windows 10 Version 1803 for x64-based Systems
Version: Windows 10 Version 1803 for ARM64-based Systems
Version: Windows 10 Version 1809 for 32-bit Systems
Version: Windows 10 Version 1809 for x64-based Systems
Version: Windows 10 Version 1809 for ARM64-based Systems
Version: Windows Server 2019
Version: Windows 10 Version 1709 for ARM64-based Systems

Microsoft

ChakraCore

Version: unspecified

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T17:51:27.155Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "106889",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/106889"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0644"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Microsoft Edge",
          "vendor": "Microsoft",
          "versions": [
            {
              "status": "affected",
              "version": "Windows Server 2016"
            },
            {
              "status": "affected",
              "version": "Windows 10 Version 1607 for 32-bit Systems"
            },
            {
              "status": "affected",
              "version": "Windows 10 Version 1607 for x64-based Systems"
            },
            {
              "status": "affected",
              "version": "Windows 10 Version 1703 for 32-bit Systems"
            },
            {
              "status": "affected",
              "version": "Windows 10 Version 1703 for x64-based Systems"
            },
            {
              "status": "affected",
              "version": "Windows 10 Version 1709 for 32-bit Systems"
            },
            {
              "status": "affected",
              "version": "Windows 10 Version 1709 for x64-based Systems"
            },
            {
              "status": "affected",
              "version": "Windows 10 Version 1803 for 32-bit Systems"
            },
            {
              "status": "affected",
              "version": "Windows 10 Version 1803 for x64-based Systems"
            },
            {
              "status": "affected",
              "version": "Windows 10 Version 1803 for ARM64-based Systems"
            },
            {
              "status": "affected",
              "version": "Windows 10 Version 1809 for 32-bit Systems"
            },
            {
              "status": "affected",
              "version": "Windows 10 Version 1809 for x64-based Systems"
            },
            {
              "status": "affected",
              "version": "Windows 10 Version 1809 for ARM64-based Systems"
            },
            {
              "status": "affected",
              "version": "Windows Server 2019"
            },
            {
              "status": "affected",
              "version": "Windows 10 Version 1709 for ARM64-based Systems"
            }
          ]
        },
        {
          "product": "ChakraCore",
          "vendor": "Microsoft",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified"
            }
          ]
        }
      ],
      "datePublic": "2019-03-05T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka \u0027Scripting Engine Memory Corruption Vulnerability\u0027. This CVE ID is unique from CVE-2019-0590, CVE-2019-0591, CVE-2019-0593, CVE-2019-0605, CVE-2019-0607, CVE-2019-0610, CVE-2019-0640, CVE-2019-0642, CVE-2019-0651, CVE-2019-0652, CVE-2019-0655."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Remote Code Execution",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-03-06T10:57:01",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "106889",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/106889"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0644"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secure@microsoft.com",
          "ID": "CVE-2019-0644",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Microsoft Edge",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Windows Server 2016"
                          },
                          {
                            "version_value": "Windows 10 Version 1607 for 32-bit Systems"
                          },
                          {
                            "version_value": "Windows 10 Version 1607 for x64-based Systems"
                          },
                          {
                            "version_value": "Windows 10 Version 1703 for 32-bit Systems"
                          },
                          {
                            "version_value": "Windows 10 Version 1703 for x64-based Systems"
                          },
                          {
                            "version_value": "Windows 10 Version 1709 for 32-bit Systems"
                          },
                          {
                            "version_value": "Windows 10 Version 1709 for x64-based Systems"
                          },
                          {
                            "version_value": "Windows 10 Version 1803 for 32-bit Systems"
                          },
                          {
                            "version_value": "Windows 10 Version 1803 for x64-based Systems"
                          },
                          {
                            "version_value": "Windows 10 Version 1803 for ARM64-based Systems"
                          },
                          {
                            "version_value": "Windows 10 Version 1809 for 32-bit Systems"
                          },
                          {
                            "version_value": "Windows 10 Version 1809 for x64-based Systems"
                          },
                          {
                            "version_value": "Windows 10 Version 1809 for ARM64-based Systems"
                          },
                          {
                            "version_value": "Windows Server 2019"
                          },
                          {
                            "version_value": "Windows 10 Version 1709 for ARM64-based Systems"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "ChakraCore",
                      "version": {
                        "version_data": [
                          {
                            "version_value": ""
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Microsoft"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka \u0027Scripting Engine Memory Corruption Vulnerability\u0027. This CVE ID is unique from CVE-2019-0590, CVE-2019-0591, CVE-2019-0593, CVE-2019-0605, CVE-2019-0607, CVE-2019-0610, CVE-2019-0640, CVE-2019-0642, CVE-2019-0651, CVE-2019-0652, CVE-2019-0655."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Remote Code Execution"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "106889",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/106889"
            },
            {
              "name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0644",
              "refsource": "CONFIRM",
              "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0644"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2019-0644",
    "datePublished": "2019-03-06T00:00:00",
    "dateReserved": "2018-11-26T00:00:00",
    "dateUpdated": "2024-08-04T17:51:27.155Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted