Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ChakraCore servicing update for August, 2019 #6243

Merged
merged 8 commits into from
Aug 13, 2019

Commits on Aug 12, 2019

  1. [CVE-2019-1141] Chakra JIT Type Confusion

    During the loop prepass the index variable is not fully constructed, so we can't rely it being negative
    So we need to kiil the object type.
    akroshg authored and wyrichte committed Aug 12, 2019
    Configuration menu
    Copy the full SHA
    329d9d2 View commit details
    Browse the repository at this point in the history

Commits on Aug 13, 2019

  1. Configuration menu
    Copy the full SHA
    bf52b6c View commit details
    Browse the repository at this point in the history
  2. [CVE-2019-1131] Chakra Type confusion

    boingoing authored and wyrichte committed Aug 13, 2019
    Configuration menu
    Copy the full SHA
    242c59e View commit details
    Browse the repository at this point in the history
  3. Configuration menu
    Copy the full SHA
    dce7443 View commit details
    Browse the repository at this point in the history
  4. [CVE-2019-1139] Chakra JIT Type Confusion

    array.slice converts the native array to var array which was not captured during the optimization.
    Due to that the native array type is forced to var array which leads to the type confusion.
    Fixed this by killing the object type for the slice (as well as concat)
    akroshg authored and wyrichte committed Aug 13, 2019
    Configuration menu
    Copy the full SHA
    ae8a8d9 View commit details
    Browse the repository at this point in the history
  5. [CVE-2019-1195] Chakra Type Confusion RCE

    pleath authored and wyrichte committed Aug 13, 2019
    Configuration menu
    Copy the full SHA
    c70af48 View commit details
    Browse the repository at this point in the history
  6. Handling exception while GetJSONObject in script debugger.

    During GetChildren phase when we try to build JSON object we might throw exception. That skipped calling .Detach on the AutoPtr - which leads to release
    the debugger property again.
    Fixed that by catching and discarding the exception.
    akroshg authored and wyrichte committed Aug 13, 2019
    Configuration menu
    Copy the full SHA
    797ddb0 View commit details
    Browse the repository at this point in the history
  7. Update version to 1.11.12

    wyrichte committed Aug 13, 2019
    Configuration menu
    Copy the full SHA
    450a349 View commit details
    Browse the repository at this point in the history