Cloudanix VulnDB

CVE-2018-0860

High · 7.5

CVSS

7.5

EPSS

68.4%

Published

Feb 15, 2018

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Attend

A flaw in how certain software handles memory can let attackers run their own programs on a computer when a user opens a specially crafted file or webpage.

Exploit Available
Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
High
Impact
Remote Code Execution
Component
Application
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Memory corruption in the scripting engine when handling objects in memory leads to remote code execution.

Why it matters to the business

Enables attackers to run arbitrary code on affected systems via crafted content, risking full compromise. High and rising EPSS indicates active exploitation potential; impacts multiple binutils packages across Debian and Ubuntu distributions with fixes available for years.

How an attack unfolds

An attacker sends a malicious webpage or document that triggers the memory corruption flaw in the scripting engine, allowing code execution in the context of the current user. Exploit code is publicly available.

How to fix it

Upgrade binutils packages to fixed versions: Debian 11/12/13/10 to 2.29.90.20180122-1; Ubuntu Pro 16.04 LTS to 2.26.1-1ubuntu1~16.04.8+esm1.

How to confirm the fix worked

Confirm installed package versions match or exceed the listed fixed versions using package manager queries.

Typical attack path

  1. Deliver malicious content via network or email
  2. Victim opens content in affected browser or application
  3. Scripting engine processes malformed objects causing memory corruption
  4. Attacker gains arbitrary code execution

How to detect it

Examine browser process logs and memory artifacts for signs of unexpected code execution following content rendering; review system logs for anomalous process creation tied to scripting components.

What your security team should do

  • Apply updates to all listed binutils packages immediately given public exploit availability
  • Review and restrict scripting engine exposure in browsers
  • Monitor EPSS trend for changes in exploitation likelihood

The record

Microsoft Edge and ChakraCore in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2018-0834, CVE-2018-0835, CVE-2018-0836, CVE-2018-0837, CVE-2018-0838, CVE-2018-0840, CVE-2018-0856, CVE-2018-0857, CVE-2018-0858, CVE-2018-0859, CVE-2018-0861, and CVE-2018-0866.

Affected packages

Ecosystem Package Introduced Fixed
NuGet Microsoft.ChakraCore 0 1.8.1

Related vulnerabilities