CVE-2019-11775

    Dashboard / Vulnerabilities / CVE-2019-11775

    CVE-2019-11775

    Published: 30 Jul 2019Last Modified: 3 Sept 2026

    Summary:

    Details: All builds of Eclipse OpenJ9 prior to 0.15 contain a bug where the loop versioner may fail to privatize a value that is pulled out of the loop by versioning - for example if there is a condition that is moved out of the loop that reads a field we may not privatize the value of that field in the modified copy of the loop allowing the test to see one value of the field and subsequently the loop to see a modified field value without retesting the condition moved out of the loop. This can lead to a variety of different issues but read out of array bounds is one major consequence of these problems.

    References: https://access.redhat.com/errata/RHSA-2019:2494, https://access.redhat.com/errata/RHSA-2019:2495, https://access.redhat.com/errata/RHSA-2019:2585, https://access.redhat.com/errata/RHSA-2019:2590, https://access.redhat.com/errata/RHSA-2019:2592, https://access.redhat.com/errata/RHSA-2019:2737, https://bugs.eclipse.org/bugs/show_bug.cgi?id=549601

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -4a7a6b2b1e74c15ddbe8fea47e3d3fba21f91cd6

    Affected versions

    openj9-0.15.0-m1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High