CVE-2019-11772

    Dashboard / Vulnerabilities / CVE-2019-11772

    CVE-2019-11772

    Published: 17 Jul 2019Last Modified: 3 Sept 2026

    Summary:

    Details: In Eclipse OpenJ9 prior to 0.15, the String.getBytes(int, int, byte[], int) method does not verify that the provided byte array is non-null nor that the provided index is in bounds when compiled by the JIT. This allows arbitrary writes to any 32-bit address or beyond the end of a byte array within Java code run under a SecurityManager.

    References: https://access.redhat.com/errata/RHSA-2019:2585, https://access.redhat.com/errata/RHSA-2019:2590, https://access.redhat.com/errata/RHSA-2019:2592, https://access.redhat.com/errata/RHSA-2019:2737, https://bugs.eclipse.org/bugs/show_bug.cgi?id=549075

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -4a7a6b2b1e74c15ddbe8fea47e3d3fba21f91cd6

    Affected versions

    openj9-0.15.0-m1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2019-11772 | CVE-DB