CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2019-11771
https://notcve.org/view.php?id=CVE-2019-11771
17 Jul 2019 — AIX builds of Eclipse OpenJ9 before 0.15.0 contain unused RPATHs which may facilitate code injection and privilege elevation by local users. Las compilaciones de AIX de OpenJ9 anterior a versión 0.15.0 de Eclipse, contienen RPATHs no utilizados que pueden facilitar la inyección de código y la elevación de privilegios por parte de los usuarios locales. • https://bugs.eclipse.org/bugs/show_bug.cgi?id=548055 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.5EPSS: 0%CPEs: 9EXPL: 0CVE-2019-10245 – JDK: Read beyond the end of bytecode array causing JVM crash
https://notcve.org/view.php?id=CVE-2019-10245
19 Apr 2019 — In Eclipse OpenJ9 prior to the 0.14.0 release, the Java bytecode verifier incorrectly allows a method to execute past the end of bytecode array causing crashes. Eclipse OpenJ9 v0.14.0 correctly detects this case and rejects the attempted class load. En Eclipse OpenJ9, en versiones anteriores a 0.14.0, el verificador bytecode de Java permite incorrectamente que un método se ejecute más allá del final de la matriz de código de bytes causando cierres inesperados. Eclipse OpenJ9 versión 0.14.0 detecta correctam... • http://www.securityfocus.com/bid/108094 • CWE-20: Improper Input Validation CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-125: Out-of-bounds Read •
CVSS: 9.8EPSS: 0%CPEs: 8EXPL: 1CVE-2018-12547 – JDK: buffer overflow in jio_snprintf() and jio_vsnprintf()
https://notcve.org/view.php?id=CVE-2018-12547
11 Feb 2019 — In Eclipse OpenJ9, prior to the 0.12.0 release, the jio_snprintf() and jio_vsnprintf() native methods ignored the length parameter. This affects existing APIs that called the functions to exceed the allocated buffer. This functions were not directly callable by non-native user code. En Eclipse OpenJ9, en versiones anteriores a la 0.12.0, los métodos nativos jio_snprintf() y jio_vsnprintf() ignoraban el parámetro length. Esto afecta a las API existentes que llamaban a las funciones para sobrepasar el búfer a... • https://access.redhat.com/errata/RHSA-2019:0469 • CWE-20: Improper Input Validation CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 9.8EPSS: 0%CPEs: 8EXPL: 0CVE-2018-12549 – JDK: missing null check when accelerating Unsafe calls
https://notcve.org/view.php?id=CVE-2018-12549
11 Feb 2019 — In Eclipse OpenJ9 version 0.11.0, the OpenJ9 JIT compiler may incorrectly omit a null check on the receiver object of an Unsafe call when accelerating it. En Eclipse OpenJ9 0.11.0, el compilador JIT de OpenJ9 podría omitir incorrectamente una comprobación nula en el objeto recibidor de una llamada no segura al acelerarla. IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. This update upgrades IBM Java SE 8 to version 8 SR5-FP35. Issues addressed includ... • https://access.redhat.com/errata/RHSA-2019:0469 • CWE-20: Improper Input Validation CWE-111: Direct Use of Unsafe JNI •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2018-12548
https://notcve.org/view.php?id=CVE-2018-12548
31 Jan 2019 — In OpenJDK + Eclipse OpenJ9 version 0.11.0 builds, the public jdk.crypto.jniprovider.NativeCrypto class contains public static natives which accept pointer values that are dereferenced in the native code. En OpenJDK + Eclipse OpenJ9 en versiones con build 0.11.0, la clase pública jdk.crypto.jniprovider.NativeCrypto contiene nativos de estado públicos que aceptan valores de puntero que se desreferencian en el código nativo. • https://bugs.eclipse.org/bugs/show_bug.cgi?id=543792 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-822: Untrusted Pointer Dereference •
CVSS: 8.4EPSS: 0%CPEs: 3EXPL: 0CVE-2018-12539 – JDK: privilege escalation via insufficiently restricted access to Attach API
https://notcve.org/view.php?id=CVE-2018-12539
14 Aug 2018 — In Eclipse OpenJ9 version 0.8, users other than the process owner may be able to use Java Attach API to connect to an Eclipse OpenJ9 or IBM JVM on the same machine and use Attach API operations, which includes the ability to execute untrusted native code. Attach API is enabled by default on Windows, Linux and AIX JVMs and can be disabled using the command line option -Dcom.ibm.tools.attach.enable=no. En Eclipse OpenJ9 0.8, otros usuarios diferentes al propietario del proceso podrían emplear la API Java Atta... • http://www.securityfocus.com/bid/105126 • CWE-287: Improper Authentication CWE-419: Unprotected Primary Channel CWE-502: Deserialization of Untrusted Data •