CVE-2019-11772: eclipse openj9 Out-of-bounds Write
Vulnerability summary
CVE-2019-11772 is a critical (CVSS 9.8) Out-of-bounds Write vulnerability in eclipse openj9. EPSS estimates a 2.10% chance of exploitation in the next 30 days, higher than 81.3% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 6 · Related 2Timeline
- 17-07-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
In Eclipse OpenJ9 prior to 0.15, the String.getBytes(int, int, byte[], int) method does not verify that the provided byte array is non-null nor that the provided index is in bounds when compiled by the JIT. This allows arbitrary writes to any 32-bit address or beyond the end of a byte array within Java code run under a SecurityManager.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
2.10%
Chance of exploitation in the next 30 days
Percentile
81%
Versus all other CVEs
30-day change
0.00 pp
From 2.10% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Eclipse1 product
- openj9< 0.15.0
The eclipse foundation1 product
- eclipse openj9≥ unspecified, < 0.15.0
2 vendors · 2 products