Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2019-17639

In Eclipse OpenJ9 prior to version 0.21 on Power platforms, calling the System.arraycopy method with a length longer than the length of the source or destination array can, in certain specially crafted code patterns, cause the current method to return prematurely with an undefined return value. This allows whatever value happens to be in the return register at that time to be used as if it matches the method's declared return type.

Published

2020-07-15T22:15:13.577

Last Modified

2024-11-21T04:32:41.010

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 5.3 (MEDIUM)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: NONE
  • Availability Impact: NONE
Exploitability Score

10.0

Impact Score

2.9

Weaknesses
  • Type: Secondary
    CWE-843
  • Type: Primary
    CWE-843
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application eclipse openj9 ≤ 0.20.0 Yes
Application eclipse openj9 0.21.0 Yes
Application eclipse openj9 0.21.0 Yes
Application eclipse openj9 0.21.0 Yes
References