CVE-2019-10245: Buffer Overflow
IBM JDK 7 SR10 FP45 (7.0.10.45), 7.1 SR4 FP45 (7.1.4.45), and 8 SR5 FP35 (8.0.5.35) fix a flaw described by upstream as:
Eclipse OpenJ9 is vulnerable to a denial of service, caused by the execution of a method past the end of bytecode array by the Java bytecode verifier. A remote attacker could exploit this vulnerability to cause the application to crash.
OpenJ9 upstream bug:
https://bugs.eclipse.org/bugs/showbug.cgi?id=545588
OpenJ9 upstream merge requests:
https://github.com/eclipse/openj9/pull/5528 https://github.com/eclipse/openj9/pull/5529
References:
https://www-01.ibm.com/support/docview.wss?uid=ibm10882850 https://developer.ibm.com/javasdk/support/security-vulnerabilities/#IBMSecurityUpdateApril2019
Other sources
In Eclipse OpenJ9 prior to the 0.14.0 release, the Java bytecode verifier incorrectly allows a method to execute past the end of bytecode array causing crashes. Eclipse OpenJ9 v0.14.0 correctly detects this case and rejects the attempted class load.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2019-10245?
CVE-2019-10245 is a vulnerability in Eclipse OpenJ9 prior to the 0.14.0 release that allows a method to execute past the end of the bytecode array, causing crashes.
What is the severity of CVE-2019-10245?
CVE-2019-10245 has a severity of 7.5 (High).
Which software is affected by CVE-2019-10245?
Eclipse OpenJ9 prior to version 0.14.0, Redhat Satellite version 5.8, and Redhat Enterprise Linux versions 8.0, 6.0, 7.0 are affected by CVE-2019-10245.
How can I fix CVE-2019-10245 in Eclipse OpenJ9?
To fix CVE-2019-10245 in Eclipse OpenJ9, you need to upgrade to version 0.14.0 or later.
Are there any references for CVE-2019-10245?
Yes, you can find more information about CVE-2019-10245 in the following references: [link1] and [link2].