Out-of-Bounds Affecting java-1.8.0-ibm-devel package, versions <1:1.8.0.5.40-3.el8_0


Severity

Recommended
0.0
high
0
10

Based on Red Hat Enterprise Linux security rating.

Threat Intelligence

EPSS
1.15% (86th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL8-JAVA180IBMDEVEL-3451429
  • published26 Jul 2021
  • disclosed1 Aug 2019

Introduced: 1 Aug 2019

CVE-2019-11775  (opens in a new tab)
CWE-119  (opens in a new tab)

How to fix?

Upgrade RHEL:8 java-1.8.0-ibm-devel to version 1:1.8.0.5.40-3.el8_0 or higher.
This issue was patched in RHSA-2019:2590.

NVD Description

Note: Versions mentioned in the description apply only to the upstream java-1.8.0-ibm-devel package and not the java-1.8.0-ibm-devel package as distributed by RHEL. See How to fix? for RHEL:8 relevant fixed versions and status.

All builds of Eclipse OpenJ9 prior to 0.15 contain a bug where the loop versioner may fail to privatize a value that is pulled out of the loop by versioning - for example if there is a condition that is moved out of the loop that reads a field we may not privatize the value of that field in the modified copy of the loop allowing the test to see one value of the field and subsequently the loop to see a modified field value without retesting the condition moved out of the loop. This can lead to a variety of different issues but read out of array bounds is one major consequence of these problems.

CVSS Scores

version 3.1