CVE-2018-12549
published 2019-02-11CVE-2018-12549: In Eclipse OpenJ9 version 0.11.0, the OpenJ9 JIT compiler may incorrectly omit a null check on the receiver object of an Unsafe call when accelerating it.
PriorityP347critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EPSS
2.33%
81.7th percentile
In Eclipse OpenJ9 version 0.11.0, the OpenJ9 JIT compiler may incorrectly omit a null check on the receiver object of an Unsafe call when accelerating it.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| eclipse | openj9 | — | — |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_workstation | — | — |
| redhat | enterprise_linux_workstation | — | — |
| redhat | satellite | — | — |
| the_eclipse_foundation | eclipse_openj9 | — | — |
CVSS provenance
nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vendor_redhat9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
JDK: missing null check when accelerating Unsafe calls
vendor_redhat·2019-03-01·CVSS 9.8
CVE-2018-12549 [CRITICAL] CWE-20 JDK: missing null check when accelerating Unsafe calls
JDK: missing null check when accelerating Unsafe calls
In Eclipse OpenJ9 version 0.11.0, the OpenJ9 JIT compiler may incorrectly omit a null check on the receiver object of an Unsafe call when accelerating it.
Statement: This issue affects the versions of the java-1.8.0-ibm package as shipped with Red Hat Satellite 5. However, OpenJ9 is loaded only by taskomatic and Tomcat. These 2 processes are listening on the loopback interface only. This flaw is not known to be remotely exploitable under any supported scenario in Satellite 5.
Package: java-1.7.1-ibm (Red Hat Enterprise Linux 6) - Not affected
Package: java-1.7.1-ibm (Red Hat Enterprise Linux 7) - Not affected
GHSA
GHSA-xpfc-p72p-hwch: In Eclipse OpenJ9 version 0
ghsa_unreviewed·2022-05-14
CVE-2018-12549 [CRITICAL] CWE-20 GHSA-xpfc-p72p-hwch: In Eclipse OpenJ9 version 0
In Eclipse OpenJ9 version 0.11.0, the OpenJ9 JIT compiler may incorrectly omit a null check on the receiver object of an Unsafe call when accelerating it.
No detection rules found.
No public exploits indexed.
https://access.redhat.com/errata/RHSA-2019:0469https://access.redhat.com/errata/RHSA-2019:0472https://access.redhat.com/errata/RHSA-2019:0640https://access.redhat.com/errata/RHSA-2019:1238https://bugs.eclipse.org/bugs/show_bug.cgi?id=544019https://access.redhat.com/errata/RHSA-2019:0469https://access.redhat.com/errata/RHSA-2019:0472https://access.redhat.com/errata/RHSA-2019:0640https://access.redhat.com/errata/RHSA-2019:1238https://bugs.eclipse.org/bugs/show_bug.cgi?id=544019
2019-02-11
Published