The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-7200, CVE-2016-7201, CVE-2016-7202, CVE-2016-7203, CVE-2016-7208, CVE-2016-7240, and CVE-2016-7243.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code
    or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory
    Corruption Vulnerability," a different vulnerability than CVE-2016-7200, CVE-2016-7201, CVE-2016-7202,
    CVE-2016-7203, CVE-2016-7208, CVE-2016-7240, and CVE-2016-7243. (CVE-2016-7242)

The version of Microsoft Edge installed on the remote Windows host is missing Cumulative Security Update 3199057. It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities. An unauthenticated, remote attacker can exploit these vulnerabilities by convincing a user to visit a specially crafted website, resulting in the execution of arbitrary code in the context of the current user.

ID	Name	Product	Family	Type	Severity
432787	SCA: security update for Microsoft.ChakraCore (GHSA-p6f4-h6w5-9jmc)	Tenable Cloud Security	SCA Checks	Local	high
432787	SCA: security update for Microsoft.ChakraCore (GHSA-p6f4-h6w5-9jmc)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
94630	MS16-129: Cumulative Security Update for Microsoft Edge (3199057)	Nessus	Windows : Microsoft Bulletins	Local	high

Detections

Analytics

CVE-2016-7242

high

Tenable Plugins

high

high

high