Login Request a demo
Critical severity · published Feb 11, 2019
CVE-2018-12547
In Eclipse OpenJ9, prior to the 0.12.0 release, the jio_snprintf() and jio_vsnprintf() native methods ignored the length parameter
9.8
CVSS
2.7%
EPSS
No
On KEV
Description
In Eclipse OpenJ9, prior to the 0.12.0 release, the jio_snprintf() and jio_vsnprintf() native methods ignored the length parameter. This affects existing APIs that called the functions to exceed the allocated buffer. This functions were not directly callable by non-native user code.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.7% · higher than 86% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EO
Eclipse OpenJ9 · The Eclipse Foundation
before 0.12.0 · source: vendor
EL
Enterprise Linux Desktop · Redhat
6.0; 7.0 · source: NVD
EL
Enterprise Linux Server · Redhat
6.0; 7.0 · source: NVD
EL
Enterprise Linux Workstation · Redhat
6.0; 7.0 · source: NVD
OP
Openj9 · Eclipse
before 0.12.0 · source: NVD
SA
Satellite · Redhat
5.8 · source: NVD
Affected product
EO
Eclipse OpenJ9
The Eclipse Foundation
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-12547
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-12547
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:0469
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:0472
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:0473
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:0474
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:0640
access.redhat.com
https://access.redhat.com/errata/RHSA-2019:1238
More from Eclipse OpenJ9
9.8
CVE-2018-12549
In Eclipse OpenJ9 version 0.11.0, the OpenJ9 JIT compiler may incorrectly omit a null check on the receiver object of an Unsafe call when accelerating it
9.8
CVE-2018-12548
In OpenJDK + Eclipse OpenJ9 version 0.11.0 builds, the public jdk.crypto.jniprovider.NativeCrypto class contains public static natives which accept pointer values that are…
7.8
CVE-2018-12539
In Eclipse OpenJ9 version 0.8, users other than the process owner may be able to use Java Attach API to connect to an Eclipse OpenJ9 or IBM JVM on the same machine and use Attach…
6.5
CVE-2022-3676
In Eclipse Openj9 before version 0.35.0, interface calls can be inlined without a runtime type check