CVE-2025-1471: Eclipse OMR: Buffer overflow vulnerability
First published: Fri Feb 21 2025(Updated: )
In Eclipse OMR versions 0.2.0 to 0.4.0, some of the z/OS atoe print functions use a constant length buffer for string conversion. If the input format string and arguments are larger than the buffer size then buffer overflow occurs. Beginning in version 0.5.0, the conversion buffers are sized correctly and checked appropriately to prevent buffer overflows.
Credit: emo@eclipse.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Eclipse OMR | >=0.2.0<=0.4.0 | |
| >=0.2.0<=0.4.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-1471?
CVE-2025-1471 has a high severity due to the potential for buffer overflow vulnerabilities that can lead to crashes or execution of malicious code.
How do I fix CVE-2025-1471?
To fix CVE-2025-1471, update your Eclipse OMR software to version 0.5.0 or later, where the buffer overflow issue has been addressed.
Which versions of Eclipse OMR are affected by CVE-2025-1471?
Versions of Eclipse OMR from 0.2.0 up to 0.4.0 are affected by CVE-2025-1471.
What is the cause of the vulnerability CVE-2025-1471?
CVE-2025-1471 is caused by the use of constant length buffers in z/OS atoe print functions for string conversions, leading to buffer overflow when input exceeds buffer size.
Can CVE-2025-1471 lead to security breaches?
Yes, CVE-2025-1471 can lead to security breaches through buffer overflow that may allow attackers to execute arbitrary code or cause a denial of service.
- agent/weakness
- agent/title
- agent/references
- agent/type
- agent/description
- agent/first-publish-date
- agent/author
- agent/source
- agent/event
- agent/guess-ai
- agent/software-canonical-lookup
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/severity
- agent/last-modified-date
- agent/softwarecombine
- agent/tags
- collector/nvd-api
- source/NVD
- vendor/eclipse
- canonical/eclipse omr