Vulnerability Details : CVE-2018-8629

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8583, CVE-2018-8617, CVE-2018-8618, CVE-2018-8624.

Vulnerability category: Memory CorruptionExecute code

Published 2018-12-12 00:29:02

Updated 2020-08-24 17:37:01

Source Microsoft Corporation

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2018-8629

Probability of exploitation activity in the next 30 days: 0.91%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 81 % EPSS Score History EPSS FAQ

CVSS scores for CVE-2018-8629

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Source
7.6	HIGH	AV:N/AC:H/Au:N/C:C/I:C/A:C	4.9	10.0	[email protected]
Access Vector: Network Access Complexity: High Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
7.5	HIGH	CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H	1.6	5.9	[email protected]
Attack Vector: Network Attack Complexity: High Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2018-8629

CWE-787 Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

Assigned by: [email protected] (Primary)

References for CVE-2018-8629

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8629

Patch;Vendor Advisory
http://www.securityfocus.com/bid/106115

Third Party Advisory;VDB Entry

Products affected by CVE-2018-8629

Microsoft » Edge » Version: N/A
cpe:2.3:a:microsoft:edge:-:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows 10 » Version: N/A
When used together with: Microsoft » Windows 10 » Version: 1607
When used together with: Microsoft » Windows 10 » Version: 1703
When used together with: Microsoft » Windows 10 » Version: 1709
When used together with: Microsoft » Windows 10 » Version: 1803
When used together with: Microsoft » Windows 10 » Version: 1809
When used together with: Microsoft » Windows Server 2016 » Version: N/A
When used together with: Microsoft » Windows Server 2019 » Version: N/A
Microsoft » Chakracore » Version: N/A
cpe:2.3:a:microsoft:chakracore:-:*:*:*:*:*:*:*
Matching versions