eclipse openj9 CVE-2018-12549 in Eclipse and Red Hat Products
Published on February 11, 2019

product logo product logo
In Eclipse OpenJ9 version 0.11.0, the OpenJ9 JIT compiler may incorrectly omit a null check on the receiver object of an Unsafe call when accelerating it.

Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory NVD

Weakness Type

Direct Use of Unsafe JNI

When a Java application uses the Java Native Interface (JNI) to call code written in another programming language, it can expose the application to weaknesses in that code, even if those weaknesses cannot occur in Java. Many safety features that programmers may take for granted do not apply for native code, so you must carefully review all such code for potential problems. The languages used to implement native code may be more susceptible to buffer overflows and other attacks. Native code is unprotected by the security features enforced by the runtime environment, such as strong typing and array bounds checking.


Products Associated with CVE-2018-12549

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2018-12549 are published in these products:

Eclipse Openj9
 
Red Hat Satellite
 
Red Hat Enterprise Linux Desktop
 
Red Hat Enterprise Linux Server
 
Red Hat Enterprise Linux Workstation
 

Affected Versions

The Eclipse Foundation Eclipse OpenJ9 Version 0.11.0 is affected by CVE-2018-12549

Exploit Probability

EPSS
0.72%
Percentile
72.14%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.