CVE-2018-12547
published 2019-02-11CVE-2018-12547: In Eclipse OpenJ9, prior to the 0.12.0 release, the jio_snprintf() and jio_vsnprintf() native methods ignored the length parameter. This affects existing APIs…
PriorityP352critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EPSS
2.74%
84.5th percentile
In Eclipse OpenJ9, prior to the 0.12.0 release, the jio_snprintf() and jio_vsnprintf() native methods ignored the length parameter. This affects existing APIs that called the functions to exceed the allocated buffer. This functions were not directly callable by non-native user code.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| eclipse | openj9 | < 0.12.0 | 0.12.0 |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_workstation | — | — |
| redhat | enterprise_linux_workstation | — | — |
| redhat | satellite | — | — |
| the_eclipse_foundation | eclipse_openj9 | >= unspecified < 0.12.0 | 0.12.0 |
CVSS provenance
nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vendor_redhat9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
JDK: buffer overflow in jio_snprintf() and jio_vsnprintf()
vendor_redhat·2019-03-01·CVSS 9.8
CVE-2018-12547 [CRITICAL] CWE-120 JDK: buffer overflow in jio_snprintf() and jio_vsnprintf()
JDK: buffer overflow in jio_snprintf() and jio_vsnprintf()
In Eclipse OpenJ9, prior to the 0.12.0 release, the jio_snprintf() and jio_vsnprintf() native methods ignored the length parameter. This affects existing APIs that called the functions to exceed the allocated buffer. This functions were not directly callable by non-native user code.
Statement: This issue affects the versions of the java-1.8.0-ibm package as shipped with Red Hat Satellite 5. However, OpenJ9 is loaded only by taskomatic and Tomcat. These 2 processes are listening on the loopback interface only. This flaw is not known to be remotely exploitable under any supported scenario in Satellite 5.
GHSA
GHSA-5qhh-4q6m-8w7h: In Eclipse OpenJ9, prior to the 0
ghsa_unreviewed·2022-05-14
CVE-2018-12547 [CRITICAL] CWE-119 GHSA-5qhh-4q6m-8w7h: In Eclipse OpenJ9, prior to the 0
In Eclipse OpenJ9, prior to the 0.12.0 release, the jio_snprintf() and jio_vsnprintf() native methods ignored the length parameter. This affects existing APIs that called the functions to exceed the allocated buffer. This functions were not directly callable by non-native user code.
No detection rules found.
No public exploits indexed.
https://access.redhat.com/errata/RHSA-2019:0469https://access.redhat.com/errata/RHSA-2019:0472https://access.redhat.com/errata/RHSA-2019:0473https://access.redhat.com/errata/RHSA-2019:0474https://access.redhat.com/errata/RHSA-2019:0640https://access.redhat.com/errata/RHSA-2019:1238https://bugs.eclipse.org/bugs/show_bug.cgi?id=543659https://access.redhat.com/errata/RHSA-2019:0469https://access.redhat.com/errata/RHSA-2019:0472https://access.redhat.com/errata/RHSA-2019:0473https://access.redhat.com/errata/RHSA-2019:0474https://access.redhat.com/errata/RHSA-2019:0640https://access.redhat.com/errata/RHSA-2019:1238https://bugs.eclipse.org/bugs/show_bug.cgi?id=543659
2019-02-11
Published