Code

17-12 Security Update#4411

Code

Merged

chakrabot merged 16 commits intochakra-core:release/1.7chakra-core/ChakraCore:release/1.7from MikeHolman:1712MikeHolman/ChakraCore:1712Copy head branch name to clipboardDec 12, 2017

+289-123

Commits

Commits on Dec 7, 2017

• [CVE-2017-11918] JIT: Escape analysis bug - Google, Inc.

  MikeHolman

  committed
  3237eca

  Copy full SHA for 3237eca

• [CVE-2017-11911] OOB read in asm.js - Google, Inc.

  MikeHolman

  committed
  a5d6be6

  Copy full SHA for a5d6be6

• [CVE-2017-11910] Insufficient InlineCache check can lead to type confusion

  

  Penguinwizzard

  authored and

  MikeHolman

  committed
  40232a4

  Copy full SHA for 40232a4

• [CVE-2017-11912] Regex construction can depend on unintialized memory and leak stack contents

  

  Penguinwizzard

  authored and

  MikeHolman

  committed
  1e7fa7b

  Copy full SHA for 1e7fa7b

• [CVE-2017-11909] JIT: BackwardPass::RemoveEmptyLoopAfterMemOp doesn't insert branches / make break control flow - Google, Inc.

  

  Cellule

  authored and

  MikeHolman

  committed
  0e4566a

  Copy full SHA for 0e4566a

• [CVE-2017-11930] Integer overflow - Individual

  Show description for f94fda6
  

  tcare

  authored and

  MikeHolman

  committed
  f94fda6

  Copy full SHA for f94fda6

• [CVE-2017-11905] JIT optimization fixes - Internal

  MikeHolman

  committed
  d97375c

  Copy full SHA for d97375c

• [CVE-2017-11916] Remote Code Execution Vul - Qihoo 360

  

  rajatd

  authored and

  MikeHolman

  committed
  69e03c3

  Copy full SHA for 69e03c3

• [CVE-2017-11893] JIT Op_MaxInAnArray and Op_MinInAnArray can explicitly call user defined JavaScript functions - Google, Inc.

  

  rajatd

  authored and

  MikeHolman

  committed
  760822c

  Copy full SHA for 760822c

• [CVE-2017-11908] Invalid stack restore when destructuring is used as a call param

  Show description for 39eecff
  

  akroshg

  authored and

  MikeHolman

  committed
  39eecff

  Copy full SHA for 39eecff

• [CVE-2017-11914] JavascriptGeneratorFunction::GetPropertyBuiltIns exposes scriptFunction - Google, Inc.

  Show description for b488088
  

  aneeshdk

  authored and

  MikeHolman

  committed
  b488088

  Copy full SHA for b488088

• [CVE-2017-11919] An infoleak bug in the latest version of Edge - Qihoo 360

  Show description for fde1643
  

  aneeshdk

  authored and

  MikeHolman

  committed
  fde1643

  Copy full SHA for fde1643

• [CVE-2017-11889] UaF On the latest Patch - Qihoo 360

  Show description for 66b9abb
  

  Thomas Moore (CHAKRA)

  authored and

  MikeHolman

  committed
  66b9abb

  Copy full SHA for 66b9abb

• [CVE-2017-11894] An OOB Access in Chakra Engine - Individual

  Show description for 5d4aca7
  

  ricobbe

  authored and

  MikeHolman

  committed
  5d4aca7

  Copy full SHA for 5d4aca7

Commits on Dec 8, 2017

• Update ChakraCore version

  MikeHolman

  committed
  a7f6761

  Copy full SHA for a7f6761

Commits on Dec 12, 2017

• fix prefast warnings

  MikeHolman

  committed
  6e6301c

  Copy full SHA for 6e6301c