CVE-2018-12549: Input Validation
IBM JDK 8 SR5 FP30 (8.0.5.30) fixes a flaw described by upstream as:
Eclipse OpenJ9 could allow a remote attacker to execute arbitrary code on the system, caused by the failure to omit a null check on the receiver object of an Unsafe call when accelerating it. An attacker could exploit this vulnerability to execute arbitrary code on the system.
OpenJ9 upstream bug:
https://bugs.eclipse.org/bugs/showbug.cgi?id=544019
Related OpenJ9 upstream commit seems to be:
https://github.com/eclipse/openj9/commit/531d3f96fe9cdcf6baad9f6d6837be8fbc805d8d
References:
https://www-01.ibm.com/support/docview.wss?uid=ibm10873332 https://developer.ibm.com/javasdk/support/security-vulnerabilities/#IBMSecurityUpdateMarch2019
Other sources
In Eclipse OpenJ9 version 0.11.0, the OpenJ9 JIT compiler may incorrectly omit a null check on the receiver object of an Unsafe call when accelerating it.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-12549?
The severity of CVE-2018-12549 is critical with a CVSS score of 9.8.
How does CVE-2018-12549 impact Eclipse OpenJ9 version 0.11.0?
CVE-2018-12549 impacts Eclipse OpenJ9 version 0.11.0 by incorrectly omitting a null check on the receiver object of an Unsafe call when accelerating it.
Which software versions are affected by CVE-2018-12549?
CVE-2018-12549 affects Eclipse OpenJ9 version 0.11.0.
What is the Common Vulnerabilities and Exposures (CVE) ID for this vulnerability?
The Common Vulnerabilities and Exposures (CVE) ID for this vulnerability is CVE-2018-12549.
How can I fix the vulnerability in Eclipse OpenJ9 version 0.11.0?
To fix the vulnerability in Eclipse OpenJ9 version 0.11.0, it is recommended to update to a version that is not affected by the issue.