Buffer Overflow Affecting java-1.8.0-ibm-jdbc package, versions <1:1.8.0.5.35-3.el8_0


Severity

Recommended
0.0
critical
0
10

Based on Red Hat Enterprise Linux security rating.

Threat Intelligence

EPSS
1.57% (88th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL8-JAVA180IBMJDBC-4360326
  • published26 Jul 2021
  • disclosed1 Mar 2019

Introduced: 1 Mar 2019

CVE-2018-12547  (opens in a new tab)
CWE-120  (opens in a new tab)

How to fix?

Upgrade RHEL:8 java-1.8.0-ibm-jdbc to version 1:1.8.0.5.35-3.el8_0 or higher.
This issue was patched in RHSA-2019:1238.

NVD Description

Note: Versions mentioned in the description apply only to the upstream java-1.8.0-ibm-jdbc package and not the java-1.8.0-ibm-jdbc package as distributed by RHEL. See How to fix? for RHEL:8 relevant fixed versions and status.

In Eclipse OpenJ9, prior to the 0.12.0 release, the jio_snprintf() and jio_vsnprintf() native methods ignored the length parameter. This affects existing APIs that called the functions to exceed the allocated buffer. This functions were not directly callable by non-native user code.