The Eclipse Foundation Eclipse OpenJ9
14 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2022-3676 | unspecified – < 0.35.0 | In Eclipse Openj9 before version 0.35.0, interface calls can be inlined without a runtime type check. Malicious bytecode could make use of t | MEDIUM 6.5 | 0.8 % | ||
| CVE-2021-41041 | unspecified – < 0.32.0 | In Eclipse Openj9 before version 0.32.0, Java 8 & 11 fail to throw the exception captured during bytecode verification when verification is | MEDIUM 5.3 | 1.1 % | ||
| CVE-2021-28167 | unspecified – 0.25.0 | In Eclipse Openj9 to version 0.25.0, usage of the jdk.internal.reflect.ConstantPool API causes the JVM in some cases to pre-resolve certain | MEDIUM 6.5 | 1.1 % | ||
| CVE-2020-27221 | unspecified – 0.23 | In Eclipse OpenJ9 up to and including version 0.23, there is potential for a stack-based buffer overflow when the virtual machine or JNI nat | CRITICAL 9.8 | 1.6 % | ||
| CVE-2019-17639 | <= 0.21 | In Eclipse OpenJ9 prior to version 0.21 on Power platforms, calling the System.arraycopy method with a length longer than the length of the | MEDIUM 5.3 | 1.5 % | ||
| CVE-2019-17631 | 0.15 to 0.16 inclusive | From Eclipse OpenJ9 0.15 to 0.16, access to diagnostic operations such as causing a GC or creating a diagnostic file are permitted without a | CRITICAL 9.1 | 2.1 % | ||
| CVE-2019-11775 | unspecified – < 0.15.0 | All builds of Eclipse OpenJ9 prior to 0.15 contain a bug where the loop versioner may fail to privatize a value that is pulled out of the lo | HIGH 7.4 | 1.5 % | ||
| CVE-2019-11772 | unspecified – < 0.15.0 | In Eclipse OpenJ9 prior to 0.15, the String.getBytes(int, int, byte[], int) method does not verify that the provided byte array is non-null | CRITICAL 9.8 | 2.1 % | ||
| CVE-2019-11771 | unspecified – < 0.15.0 | AIX builds of Eclipse OpenJ9 before 0.15.0 contain unused RPATHs which may facilitate code injection and privilege elevation by local users. | HIGH 7.8 | 0.4 % | ||
| CVE-2019-10245 | unspecified – < 0.14.0 | In Eclipse OpenJ9 prior to the 0.14.0 release, the Java bytecode verifier incorrectly allows a method to execute past the end of bytecode ar | HIGH 7.5 | 2.5 % | ||
| CVE-2018-12549 | 0.11.0 | In Eclipse OpenJ9 version 0.11.0, the OpenJ9 JIT compiler may incorrectly omit a null check on the receiver object of an Unsafe call when ac | CRITICAL 9.8 | 2.3 % | ||
| CVE-2018-12547 | unspecified – < 0.12.0 | In Eclipse OpenJ9, prior to the 0.12.0 release, the jio_snprintf() and jio_vsnprintf() native methods ignored the length parameter. This aff | CRITICAL 9.8 | 2.7 % | ||
| CVE-2018-12548 | 0.11.0 | In OpenJDK + Eclipse OpenJ9 version 0.11.0 builds, the public jdk.crypto.jniprovider.NativeCrypto class contains public static natives which | CRITICAL 9.8 | 1.1 % | ||
| CVE-2018-12539 | 0.8 | In Eclipse OpenJ9 version 0.8, users other than the process owner may be able to use Java Attach API to connect to an Eclipse OpenJ9 or IBM | HIGH 7.8 | 0.5 % |