18-01 Security Update - #4503
Merged
Merged
Conversation
meg-gupta
approved these changes
Jan 5, 2018
leirocks
approved these changes
Jan 5, 2018
Collaborator
|
Not sure why my commits are here? (side note; they are already on 1.7) |
Cellule
approved these changes
Jan 5, 2018
atulkatti
approved these changes
Jan 5, 2018
Contributor
Author
|
@obastemur -- yeah...I will look into fixing this before I submit. that was fallout from my rebasing |
… lead to UAF - Individual
This change fixes a type-confusion bug that can occur with Native arrays allocated on the stack. Once JIT'd code expects a Native array to be used on the stack, the POC converts it to a Var array. This is combined with current behavior of the Arguments property, which moves the array from the stack to the heap. The result of these two assumptions is natively setting a Float value where a Var value is expected, letting any arbitrary floating-point number be written to memory and subsequently accessed as a Var. This fix forces a deep copy of Arrays that are returned via Arguments. This ensures that the new object created points to its own buffers. This also indicates a divergence with the original object and the one created by Arguments; however, there is currently no standard to define this behavior.
…s in OOB Read - Google, Inc.
The variable was declared inside an if-else condition and is used outside the block.
…AsConstructor stackArgs variable is declared inside an if block but used outside of the block.
…hodJsPolymorphicInlineCache - Palo Alto Networks, Inc.
…kMap32::L2MapChunk::Set+2e - Individual
…using RCE - Individual
…- Qihoo 360 Dynamic import keyword should have been disabled. The bug exploits our use of JavascriptError::SetErrorMessageProperties with the underlying buffer from a JavascriptString object which might get collected leading to use after free of that buffer. Fix here disables dynamic import feature and fixes the exploit since some of that code is shared with other components.
This feature is now experimental.
chakrabot
pushed a commit
that referenced
this pull request
Jan 5, 2018
Merge pull request #4503 from thomasmo:1801 18-01 Security Update that addresses the following issues in ChakraCore: CVE-2018-0758 CVE-2018-0762 CVE-2018-0767 CVE-2018-0768 CVE-2018-0769 CVE-2018-0770 CVE-2018-0772 CVE-2018-0773 CVE-2018-0774 CVE-2018-0775 CVE-2018-0776 CVE-2018-0777 CVE-2018-0778 CVE-2018-0780 CVE-2018-0781
chakrabot
pushed a commit
that referenced
this pull request
Jan 9, 2018
Merge pull request #4503 from thomasmo:1801 18-01 Security Update that addresses the following issues in ChakraCore: CVE-2018-0758 CVE-2018-0762 CVE-2018-0767 CVE-2018-0768 CVE-2018-0769 CVE-2018-0770 CVE-2018-0772 CVE-2018-0773 CVE-2018-0774 CVE-2018-0775 CVE-2018-0776 CVE-2018-0777 CVE-2018-0778 CVE-2018-0780 CVE-2018-0781
chakrabot
pushed a commit
that referenced
this pull request
Jan 9, 2018
Merge pull request #4503 from thomasmo:1801 18-01 Security Update that addresses the following issues in ChakraCore: CVE-2018-0758 CVE-2018-0762 CVE-2018-0767 CVE-2018-0768 CVE-2018-0769 CVE-2018-0770 CVE-2018-0772 CVE-2018-0773 CVE-2018-0774 CVE-2018-0775 CVE-2018-0776 CVE-2018-0777 CVE-2018-0778 CVE-2018-0780 CVE-2018-0781
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
11 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
18-01 Security Update that addresses the following issues in ChakraCore:
CVE-2018-0758
CVE-2018-0762
CVE-2018-0767
CVE-2018-0768
CVE-2018-0769
CVE-2018-0770
CVE-2018-0772
CVE-2018-0773
CVE-2018-0774
CVE-2018-0775
CVE-2018-0776
CVE-2018-0777
CVE-2018-0778
CVE-2018-0780
CVE-2018-0781