CVE-2019-10245

moderate-risk
Published 2019-04-19

In Eclipse OpenJ9 prior to the 0.14.0 release, the Java bytecode verifier incorrectly allows a method to execute past the end of bytecode array causing crashes. Eclipse OpenJ9 v0.14.0 correctly detects this case and rejects the attempted class load.

Do I need to act?

~
1.5% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.5/10 High
NETWORK / LOW complexity

Affected Products (9)

Affected Vendors

Redhat Eclipse

References (16)

Third Party Advisory http://www.securityfocus.com/bid/108094
Third Party Advisory https://access.redhat.com/errata/RHSA-2019:1163
Third Party Advisory https://access.redhat.com/errata/RHSA-2019:1164
Third Party Advisory https://access.redhat.com/errata/RHSA-2019:1165
Third Party Advisory https://access.redhat.com/errata/RHSA-2019:1166
Third Party Advisory https://access.redhat.com/errata/RHSA-2019:1238
Third Party Advisory https://access.redhat.com/errata/RHSA-2019:1325
Issue Tracking https://bugs.eclipse.org/bugs/show_bug.cgi?id=545588
Third Party Advisory http://www.securityfocus.com/bid/108094
Third Party Advisory https://access.redhat.com/errata/RHSA-2019:1163
Third Party Advisory https://access.redhat.com/errata/RHSA-2019:1164
Third Party Advisory https://access.redhat.com/errata/RHSA-2019:1165
Third Party Advisory https://access.redhat.com/errata/RHSA-2019:1166
Third Party Advisory https://access.redhat.com/errata/RHSA-2019:1238
Third Party Advisory https://access.redhat.com/errata/RHSA-2019:1325
Issue Tracking https://bugs.eclipse.org/bugs/show_bug.cgi?id=545588
45
/ 100
moderate-risk
Severity 26/34 · High
Exploitability 4/34 · Minimal
Exposure 15/34 · Moderate