CVE-2019-17639 Vulnerability Details

  /     /     /  

CVE-2019-17639 Metadata Quick Info

CVE Published: 15/07/2020 | CVE Updated: 05/08/2024 | CVE Year: 2019
Source: eclipse | Vendor: The Eclipse Foundation | Product: Eclipse OpenJ9
Status : PUBLISHED

---

CVE-2019-17639 Description

In Eclipse OpenJ9 prior to version 0.21 on Power platforms, calling the System.arraycopy method with a length longer than the length of the source or destination array can, in certain specially crafted code patterns, cause the current method to return prematurely with an undefined return value. This allows whatever value happens to be in the return register at that time to be used as if it matches the method\'s declared return type.

Metrics

CVSS Version: 3.1 | Base Score: n/a
Vector: n/a

l➤ Exploitability Metrics:
    Attack Vector (AV)*
    Attack Complexity (AC)*
    Privileges Required (PR)*
    User Interaction (UI)*
    Scope (S)*

l➤ Impact Metrics:
    Confidentiality Impact (C)*
    Integrity Impact (I)*
    Availability Impact (A)*

Weakness Enumeration (CWE)

CWE-ID: CWE-843
CWE Name: CWE-843: Access of Resource Using Incompatible Type ( Type Confusion )
Source: The Eclipse Foundation

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description:


Source: NVD (National Vulnerability Database).