Microsoft Edge脚本引擎内存损坏漏洞(CVE-2016-7201)

详细信息

漏洞类型

缓冲区错误

漏洞描述

Microsoft Edge是美国微软（Microsoft）公司开发的一款Web浏览器，是Windows 10操作系统附带的默认浏览器。Microsoft Edge中存在远程执行代码漏洞，该漏洞源于程序没有正确处理内存中的对象。攻击者可利用该漏洞在当前用户的上下文中执行任意代码，也可能造成拒绝服务（内存损坏）。

修复建议

目前厂商已经发布了升级补丁以修复此安全问题，补丁获取链接： http://technet.microsoft.com/security/bulletin/MS16-129

参考链接

• http://technet.microsoft.com/security/bulletin/MS16-129

  NVD

• https://github.com/theori-io/chakra-2016-11

  OSV · x_refsource_MISC

• http://packetstormsecurity.com/files/140382/Microsoft-Edge-chakra.dll-Information-Leak-Type-Confusion.html

  OSV · x_refsource_MISC

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-129

  OSV · vendor-advisory · x_refsource_MS

• https://www.exploit-db.com/exploits/40784/

  NVD · exploit · x_refsource_EXPLOIT-DB

• https://www.exploit-db.com/exploits/40990/

  Snyk · exploit · x_refsource_EXPLOIT-DB

• https://nvd.nist.gov/vuln/detail/CVE-2016-7201

  OSV

• https://github.com/chakra-core/ChakraCore/pull/1982

  OSV

• https://github.com/chakra-core/ChakraCore/commit/c2787ef8fdb7401922e9ec6540e4e5895d11c631

  OSV

• https://github.com/advisories/GHSA-4f5g-j7wg-7w8j

  GitHub

• https://github.com/chakra-core/ChakraCore

  OSV

• https://web.archive.org/web/20210123185125/http://www.securityfocus.com/bid/94038

  OSV

• https://web.archive.org/web/20211126224744/http://www.securitytracker.com/id/1037245

  OSV

• https://www.exploit-db.com/exploits/40784

  OSV · VDB Entry · Exploit · Third Party Advisory

• https://www.exploit-db.com/exploits/40990

  OSV · VDB Entry · Exploit · Third Party Advisory

• https://osv.dev/vulnerability/GHSA-4f5g-j7wg-7w8j

  OSV

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog

  Snyk

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-7201

  NVD · US Government Resource