Vulnerability Description
All builds of Eclipse OpenJ9 prior to 0.15 contain a bug where the loop versioner may fail to privatize a value that is pulled out of the loop by versioning - for example if there is a condition that is moved out of the loop that reads a field we may not privatize the value of that field in the modified copy of the loop allowing the test to see one value of the field and subsequently the loop to see a modified field value without retesting the condition moved out of the loop. This can lead to a variety of different issues but read out of array bounds is one major consequence of these problems.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Eclipse | Openj9 | < 0.15.0 |
| Redhat | Satellite | 5.8 |
| Redhat | Enterprise Linux Desktop | 6.0 |
| Redhat | Enterprise Linux Server | 6.0 |
| Redhat | Enterprise Linux Workstation | 6.0 |
Related Weaknesses (CWE)
References
- https://access.redhat.com/errata/RHSA-2019:2494Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2495Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2585Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2590Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2592Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2737Third Party Advisory
- https://bugs.eclipse.org/bugs/show_bug.cgi?id=549601Issue TrackingVendor Advisory
- https://access.redhat.com/errata/RHSA-2019:2494Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2495Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2585Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2590Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2592Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2737Third Party Advisory
- https://bugs.eclipse.org/bugs/show_bug.cgi?id=549601Issue TrackingVendor Advisory
FAQ
What is CVE-2019-11775?
CVE-2019-11775 is a vulnerability with a CVSS score of 7.4 (HIGH). All builds of Eclipse OpenJ9 prior to 0.15 contain a bug where the loop versioner may fail to privatize a value that is pulled out of the loop by versioning - for example if there is a condition that ...
How severe is CVE-2019-11775?
CVE-2019-11775 has been rated HIGH with a CVSS base score of 7.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-11775?
Check the references section above for vendor advisories and patch information. Affected products include: Eclipse Openj9, Redhat Satellite, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Server, Redhat Enterprise Linux Workstation.