VYPR
Get started
← All advisories
High severity7.5NVD Advisory· Published Nov 15, 2017· Updated May 13, 2026

CVE-2017-11870

CVE-2017-11870

Description

ChakraCore and Microsoft Edge in Windows 10 1703, 1709, and Windows Server, version 1709 allows an attacker to gain the same user rights as the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11836, CVE-2017-11837, CVE-2017-11838, CVE-2017-11839, CVE-2017-11840, CVE-2017-11841, CVE-2017-11843, CVE-2017-11846, CVE-2017-11858, CVE-2017-11859, CVE-2017-11861, CVE-2017-11862, CVE-2017-11866, CVE-2017-11869, CVE-2017-11871, and CVE-2017-11873.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
Microsoft.ChakraCoreNuGet
< 1.7.41.7.4

Affected products

3
  • Microsoft Corporation/ChakraCore, Microsoft Edgev5
    Range: Windows 10 1703, 1709, and Windows Server, version 1709.
  • Microsoft/Chakracore
    cpe:2.3:a:microsoft:chakracore:-:*:*:*:*:*:*:*
  • Microsoft/Edge
    cpe:2.3:a:microsoft:edge:-:*:*:*:*:*:*:*

Patches

1
b44ee8300ae0

[CVE-2017-11870] Edge - Exploitable write-AV when writing to a slot of a javascript null scope object. - Internal

https://github.com/chakra-core/ChakraCoreRajat DuaOct 20, 2017via ghsa
commit
1 file changed · +4 −0
  • lib/Parser/Parse.cpp+4 −0 modified
    @@ -5194,6 +5194,10 @@ ParseNodePtr Parser::ParseFncDecl(ushort flags, LPCOLESTR pNameHint, const bool
             bool isRedecl = false;
             ParseNodePtr vardecl = CreateVarDeclNode(pnodeFnc->sxFnc.pnodeName->sxVar.pid, STVariable, false, nullptr, false, &isRedecl);
             vardecl->sxVar.isBlockScopeFncDeclVar = true;
+            if (vardecl->sxVar.sym->GetIsFormal())
+            {
+                GetCurrentFunctionNode()->sxFnc.SetHasAnyWriteToFormals(true);
+            }
             if (isRedecl)
             {
                 vardecl->sxVar.sym->SetHasBlockFncVarRedecl();

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

11

News mentions

0

No linked articles in our index yet.