Homepage

Time-of-check Time-of-use (TOCTOU) The advisory has been revoked - it doesn't affect any version of package java-1_8_0-ibm-src  (opens in a new tab)

Threat Intelligence

EPSS
1.47% (71st percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-SLES151-JAVA180IBMSRC-2735325
  • published14 Apr 2022
  • disclosed4 Sept 2019
Report a new vulnerability Found a mistake?

Introduced: 4 Sep 2019

CVE-2019-11775  (opens in a new tab)
CWE-367  (opens in a new tab)

Amendment

The SLES security team deemed this advisory irrelevant for SLES:15.1.

NVD Description

Note: Versions mentioned in the description apply only to the upstream java-1_8_0-ibm-src package and not the java-1_8_0-ibm-src package as distributed by SLES.

All builds of Eclipse OpenJ9 prior to 0.15 contain a bug where the loop versioner may fail to privatize a value that is pulled out of the loop by versioning - for example if there is a condition that is moved out of the loop that reads a field we may not privatize the value of that field in the modified copy of the loop allowing the test to see one value of the field and subsequently the loop to see a modified field value without retesting the condition moved out of the loop. This can lead to a variety of different issues but read out of array bounds is one major consequence of these problems.