CVE-2019-10245

JDK: Read beyond the end of bytecode array causing JVM crash

Severity Score

7.5

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

In Eclipse OpenJ9 prior to the 0.14.0 release, the Java bytecode verifier incorrectly allows a method to execute past the end of bytecode array causing crashes. Eclipse OpenJ9 v0.14.0 correctly detects this case and rejects the attempted class load.

En Eclipse OpenJ9, en versiones anteriores a 0.14.0, el verificador bytecode de Java permite incorrectamente que un método se ejecute más allá del final de la matriz de código de bytes causando cierres inesperados. Eclipse OpenJ9 versión 0.14.0 detecta correctamente este caso y rechaza la carga de clase intentada

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

None

Integrity

None

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2019-03-27 CVE Reserved
2019-04-19 CVE Published
2024-08-04 CVE Updated
2024-09-09 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-20: Improper Input Validation
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-125: Out-of-bounds Read

CAPEC

References (10)

URL	Tag	Source
http://www.securityfocus.com/bid/108094	Third Party Advisory

URL	Date	SRC

URL	Date	SRC
https://bugs.eclipse.org/bugs/show_bug.cgi?id=545588	2021-10-28

URL	Date	SRC
https://access.redhat.com/errata/RHSA-2019:1163	2021-10-28
https://access.redhat.com/errata/RHSA-2019:1164	2021-10-28
https://access.redhat.com/errata/RHSA-2019:1165	2021-10-28
https://access.redhat.com/errata/RHSA-2019:1166	2021-10-28
https://access.redhat.com/errata/RHSA-2019:1238	2021-10-28
https://access.redhat.com/errata/RHSA-2019:1325	2021-10-28
https://access.redhat.com/security/cve/CVE-2019-10245	2019-06-04
https://bugzilla.redhat.com/show_bug.cgi?id=1704799	2019-06-04

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Eclipse Search vendor "Eclipse"		Openj9 Search vendor "Eclipse" for product "Openj9"				< 0.14.0 Search vendor "Eclipse" for product "Openj9" and version " < 0.14.0"		-		Affected
Redhat Search vendor "Redhat"		Satellite Search vendor "Redhat" for product "Satellite"				5.8 Search vendor "Redhat" for product "Satellite" and version "5.8"		-		Affected
Redhat Search vendor "Redhat"		Enterprise Linux Search vendor "Redhat" for product "Enterprise Linux"				8.0 Search vendor "Redhat" for product "Enterprise Linux" and version "8.0"		-		Affected
Redhat Search vendor "Redhat"		Enterprise Linux Desktop Search vendor "Redhat" for product "Enterprise Linux Desktop"				6.0 Search vendor "Redhat" for product "Enterprise Linux Desktop" and version "6.0"		-		Affected
Redhat Search vendor "Redhat"		Enterprise Linux Desktop Search vendor "Redhat" for product "Enterprise Linux Desktop"				7.0 Search vendor "Redhat" for product "Enterprise Linux Desktop" and version "7.0"		-		Affected
Redhat Search vendor "Redhat"		Enterprise Linux Server Search vendor "Redhat" for product "Enterprise Linux Server"				6.0 Search vendor "Redhat" for product "Enterprise Linux Server" and version "6.0"		-		Affected
Redhat Search vendor "Redhat"		Enterprise Linux Server Search vendor "Redhat" for product "Enterprise Linux Server"				7.0 Search vendor "Redhat" for product "Enterprise Linux Server" and version "7.0"		-		Affected
Redhat Search vendor "Redhat"		Enterprise Linux Workstation Search vendor "Redhat" for product "Enterprise Linux Workstation"				6.0 Search vendor "Redhat" for product "Enterprise Linux Workstation" and version "6.0"		-		Affected
Redhat Search vendor "Redhat"		Enterprise Linux Workstation Search vendor "Redhat" for product "Enterprise Linux Workstation"				7.0 Search vendor "Redhat" for product "Enterprise Linux Workstation" and version "7.0"		-		Affected