{"containers": {"cna": {"affected": [{"product": "Eclipse OpenJ9", "vendor": "The Eclipse Foundation", "versions": [{"lessThan": "0.15.0", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "All builds of Eclipse OpenJ9 prior to 0.15 contain a bug where the loop versioner may fail to privatize a value that is pulled out of the loop by versioning - for example if there is a condition that is moved out of the loop that reads a field we may not privatize the value of that field in the modified copy of the loop allowing the test to see one value of the field and subsequently the loop to see a modified field value without retesting the condition moved out of the loop. This can lead to a variety of different issues but read out of array bounds is one major consequence of these problems."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-367", "description": "CWE-367", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2019-09-11T18:06:15", "orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c", "shortName": "eclipse"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://bugs.eclipse.org/bugs/show_bug.cgi?id=549601"}, {"name": "RHSA-2019:2494", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2019:2494"}, {"name": "RHSA-2019:2495", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2019:2495"}, {"name": "RHSA-2019:2585", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2019:2585"}, {"name": "RHSA-2019:2590", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2019:2590"}, {"name": "RHSA-2019:2592", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2019:2592"}, {"name": "RHSA-2019:2737", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2019:2737"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@eclipse.org", "ID": "CVE-2019-11775", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Eclipse OpenJ9", "version": {"version_data": [{"version_affected": "<", "version_value": "0.15.0"}]}}]}, "vendor_name": "The Eclipse Foundation"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "All builds of Eclipse OpenJ9 prior to 0.15 contain a bug where the loop versioner may fail to privatize a value that is pulled out of the loop by versioning - for example if there is a condition that is moved out of the loop that reads a field we may not privatize the value of that field in the modified copy of the loop allowing the test to see one value of the field and subsequently the loop to see a modified field value without retesting the condition moved out of the loop. This can lead to a variety of different issues but read out of array bounds is one major consequence of these problems."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-367"}]}]}, "references": {"reference_data": [{"name": "https://bugs.eclipse.org/bugs/show_bug.cgi?id=549601", "refsource": "CONFIRM", "url": "https://bugs.eclipse.org/bugs/show_bug.cgi?id=549601"}, {"name": "RHSA-2019:2494", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2019:2494"}, {"name": "RHSA-2019:2495", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2019:2495"}, {"name": "RHSA-2019:2585", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2019:2585"}, {"name": "RHSA-2019:2590", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2019:2590"}, {"name": "RHSA-2019:2592", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2019:2592"}, {"name": "RHSA-2019:2737", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2019:2737"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T23:03:32.862Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://bugs.eclipse.org/bugs/show_bug.cgi?id=549601"}, {"name": "RHSA-2019:2494", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "https://access.redhat.com/errata/RHSA-2019:2494"}, {"name": "RHSA-2019:2495", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "https://access.redhat.com/errata/RHSA-2019:2495"}, {"name": "RHSA-2019:2585", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "https://access.redhat.com/errata/RHSA-2019:2585"}, {"name": "RHSA-2019:2590", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "https://access.redhat.com/errata/RHSA-2019:2590"}, {"name": "RHSA-2019:2592", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "https://access.redhat.com/errata/RHSA-2019:2592"}, {"name": "RHSA-2019:2737", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "https://access.redhat.com/errata/RHSA-2019:2737"}]}]}, "cveMetadata": {"assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c", "assignerShortName": "eclipse", "cveId": "CVE-2019-11775", "datePublished": "2019-07-30T13:45:38", "dateReserved": "2019-05-06T00:00:00", "dateUpdated": "2024-08-04T23:03:32.862Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:eclipse:openj9:*:*:*:*:*:*:*:*", "matchCriteriaId": "8216721A-F120-418A-9E13-19A1D8DF1BAD", "versionEndExcluding": "0.15.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:redhat:satellite:5.8:*:*:*:*:*:*:*", "matchCriteriaId": "F4F86C3C-B99C-44C6-97D7-163DC3F59687", "vulnerable": true}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*", "matchCriteriaId": "EE249E1B-A1FD-4E08-AA71-A0E1F10FFE97", "vulnerable": true}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*", "matchCriteriaId": "33C068A4-3780-4EAB-A937-6082DF847564", "vulnerable": true}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*", "matchCriteriaId": "9BBCD86A-E6C7-4444-9D74-F861084090F0", "vulnerable": true}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*", "matchCriteriaId": "51EF4996-72F4-4FA4-814F-F5991E7A8318", "vulnerable": true}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*", "matchCriteriaId": "E5ED5807-55B7-47C5-97A6-03233F4FBC3A", "vulnerable": true}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*", "matchCriteriaId": "825ECE2D-E232-46E0-A047-074B34DB1E97", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "All builds of Eclipse OpenJ9 prior to 0.15 contain a bug where the loop versioner may fail to privatize a value that is pulled out of the loop by versioning - for example if there is a condition that is moved out of the loop that reads a field we may not privatize the value of that field in the modified copy of the loop allowing the test to see one value of the field and subsequently the loop to see a modified field value without retesting the condition moved out of the loop. This can lead to a variety of different issues but read out of array bounds is one major consequence of these problems."}, {"lang": "es", "value": "Todas las compilaciones de OpenJ9 de Eclipse anteriores a versi\u00f3n 0.15, contienen un bug donde el versionador de bucle puede fallar al privatizar un valor que se extrae del bucle mediante el versionado \u2013 por ejemplo, si hay una condici\u00f3n que es movida fuera del bucle que lee un campo no podemos privatizar el valor de ese campo en la copia modificada del bucle permitiendo a la prueba visualizar un valor del campo y posteriormente el bucle para visualizar un valor del campo modificado sin volver a probar la condici\u00f3n movida fuera del bucle. Esto puede conllevar a una variedad de problemas diferentes, pero la lectura fuera de l\u00edmites de la matriz es una consecuencia importante de estos problemas."}], "id": "CVE-2019-11775", "lastModified": "2020-10-08T14:46:51.233", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2019-07-30T14:15:14.780", "references": [{"source": "emo@eclipse.org", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/errata/RHSA-2019:2494"}, {"source": "emo@eclipse.org", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/errata/RHSA-2019:2495"}, {"source": "emo@eclipse.org", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/errata/RHSA-2019:2585"}, {"source": "emo@eclipse.org", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/errata/RHSA-2019:2590"}, {"source": "emo@eclipse.org", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/errata/RHSA-2019:2592"}, {"source": "emo@eclipse.org", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/errata/RHSA-2019:2737"}, {"source": "emo@eclipse.org", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://bugs.eclipse.org/bugs/show_bug.cgi?id=549601"}], "sourceIdentifier": "emo@eclipse.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-367"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-367"}], "source": "emo@eclipse.org", "type": "Secondary"}]}

{"affected_release": [{"advisory": "RHSA-2019:2494", "cpe": "cpe:/a:redhat:rhel_extras:6", "package": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10", "product_name": "Red Hat Enterprise Linux 6 Supplementary", "release_date": "2019-08-15T00:00:00Z"}, {"advisory": "RHSA-2019:2592", "cpe": "cpe:/a:redhat:rhel_extras:6", "package": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10", "product_name": "Red Hat Enterprise Linux 6 Supplementary", "release_date": "2019-09-03T00:00:00Z"}, {"advisory": "RHSA-2019:2495", "cpe": "cpe:/a:redhat:rhel_extras:7", "package": "java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7", "product_name": "Red Hat Enterprise Linux 7 Supplementary", "release_date": "2019-08-15T00:00:00Z"}, {"advisory": "RHSA-2019:2585", "cpe": "cpe:/a:redhat:rhel_extras:7", "package": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7", "product_name": "Red Hat Enterprise Linux 7 Supplementary", "release_date": "2019-09-02T00:00:00Z"}, {"advisory": "RHSA-2019:2590", "cpe": "cpe:/a:redhat:enterprise_linux:8::supplementary", "package": "java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2019-09-02T00:00:00Z"}, {"advisory": "RHSA-2019:2737", "cpe": "cpe:/a:redhat:network_satellite:5.8::el6", "package": "java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10", "product_name": "Red Hat Satellite 5.8", "release_date": "2019-09-11T00:00:00Z"}], "bugzilla": {"description": "JDK: Failure to privatize a value pulled out of the loop by versioning", "id": "1738549", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1738549"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "status": "verified"}, "cwe": "CWE-119", "details": ["All builds of Eclipse OpenJ9 prior to 0.15 contain a bug where the loop versioner may fail to privatize a value that is pulled out of the loop by versioning - for example if there is a condition that is moved out of the loop that reads a field we may not privatize the value of that field in the modified copy of the loop allowing the test to see one value of the field and subsequently the loop to see a modified field value without retesting the condition moved out of the loop. This can lead to a variety of different issues but read out of array bounds is one major consequence of these problems."], "name": "CVE-2019-11775", "public_date": "2019-08-01T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2019-11775\nhttps://nvd.nist.gov/vuln/detail/CVE-2019-11775"], "threat_severity": "Important"}