CVE-2019-11775
JDK: Failure to privatize a value pulled out of the loop by versioning
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
All builds of Eclipse OpenJ9 prior to 0.15 contain a bug where the loop versioner may fail to privatize a value that is pulled out of the loop by versioning - for example if there is a condition that is moved out of the loop that reads a field we may not privatize the value of that field in the modified copy of the loop allowing the test to see one value of the field and subsequently the loop to see a modified field value without retesting the condition moved out of the loop. This can lead to a variety of different issues but read out of array bounds is one major consequence of these problems.
Todas las compilaciones de OpenJ9 de Eclipse anteriores a versión 0.15, contienen un bug donde el versionador de bucle puede fallar al privatizar un valor que se extrae del bucle mediante el versionado – por ejemplo, si hay una condición que es movida fuera del bucle que lee un campo no podemos privatizar el valor de ese campo en la copia modificada del bucle permitiendo a la prueba visualizar un valor del campo y posteriormente el bucle para visualizar un valor del campo modificado sin volver a probar la condición movida fuera del bucle. Esto puede conllevar a una variedad de problemas diferentes, pero la lectura fuera de límites de la matriz es una consecuencia importante de estos problemas.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2019-05-06 CVE Reserved
- 2019-07-30 CVE Published
- 2024-07-23 EPSS Updated
- 2024-08-04 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
- CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
CAPEC
References (9)
URL | Tag | Source |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
https://access.redhat.com/errata/RHSA-2019:2494 | 2020-10-08 | |
https://access.redhat.com/errata/RHSA-2019:2495 | 2020-10-08 | |
https://access.redhat.com/errata/RHSA-2019:2585 | 2020-10-08 | |
https://access.redhat.com/errata/RHSA-2019:2590 | 2020-10-08 | |
https://access.redhat.com/errata/RHSA-2019:2592 | 2020-10-08 | |
https://access.redhat.com/errata/RHSA-2019:2737 | 2020-10-08 | |
https://bugs.eclipse.org/bugs/show_bug.cgi?id=549601 | 2020-10-08 | |
https://access.redhat.com/security/cve/CVE-2019-11775 | 2019-09-11 | |
https://bugzilla.redhat.com/show_bug.cgi?id=1738549 | 2019-09-11 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Eclipse Search vendor "Eclipse" | Openj9 Search vendor "Eclipse" for product "Openj9" | < 0.15.0 Search vendor "Eclipse" for product "Openj9" and version " < 0.15.0" | - |
Affected
| ||||||
Redhat Search vendor "Redhat" | Satellite Search vendor "Redhat" for product "Satellite" | 5.8 Search vendor "Redhat" for product "Satellite" and version "5.8" | - |
Affected
| ||||||
Redhat Search vendor "Redhat" | Enterprise Linux Desktop Search vendor "Redhat" for product "Enterprise Linux Desktop" | 6.0 Search vendor "Redhat" for product "Enterprise Linux Desktop" and version "6.0" | - |
Affected
| ||||||
Redhat Search vendor "Redhat" | Enterprise Linux Desktop Search vendor "Redhat" for product "Enterprise Linux Desktop" | 7.0 Search vendor "Redhat" for product "Enterprise Linux Desktop" and version "7.0" | - |
Affected
| ||||||
Redhat Search vendor "Redhat" | Enterprise Linux Server Search vendor "Redhat" for product "Enterprise Linux Server" | 6.0 Search vendor "Redhat" for product "Enterprise Linux Server" and version "6.0" | - |
Affected
| ||||||
Redhat Search vendor "Redhat" | Enterprise Linux Server Search vendor "Redhat" for product "Enterprise Linux Server" | 7.0 Search vendor "Redhat" for product "Enterprise Linux Server" and version "7.0" | - |
Affected
| ||||||
Redhat Search vendor "Redhat" | Enterprise Linux Workstation Search vendor "Redhat" for product "Enterprise Linux Workstation" | 6.0 Search vendor "Redhat" for product "Enterprise Linux Workstation" and version "6.0" | - |
Affected
| ||||||
Redhat Search vendor "Redhat" | Enterprise Linux Workstation Search vendor "Redhat" for product "Enterprise Linux Workstation" | 7.0 Search vendor "Redhat" for product "Enterprise Linux Workstation" and version "7.0" | - |
Affected
|