Out-of-bounds write in OpenJ9 - CVE-2019-11772

Vulnerability identifier: #VU77347

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-11772

CWE-ID: CWE-787

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to the String.getBytes(int, int, byte[], int) method does not verify that the provided byte array is non-null nor that the provided index is in bounds when compiled by the JIT. A remote attacker can trigger an out-of-bounds write and execute arbitrary code on the target system.

OpenJ9
IBM Cloud Transformation Advisor
Red Hat Satellite
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for x86_64
java-1.8.0-ibm-devel (Red Hat package)
java-1.8.0-ibm (Red Hat package)
java-1.8.0-ibm-src (Red Hat package)
java-1.8.0-ibm-plugin (Red Hat package)
java-1.8.0-ibm-jdbc (Red Hat package)
java-1.8.0-ibm-demo (Red Hat package)
java-1.8.0-ibm-headless (Red Hat package)
java-1.8.0-ibm-webstart (Red Hat package)

Install updates from vendor's website.

OpenJ9 - update to 0.15.0
IBM Cloud Transformation Advisor - update to 2.0.2
java-1.8.0-ibm-devel (Red Hat package) - addressed in versions 1.8.0.5.40-1jpp.1.el6_10, 1.8.0.5.40-1jpp.1.el7, 1.8.0.5.40-3.el8_0
java-1.8.0-ibm (Red Hat package) - addressed in versions 1.8.0.5.40-1jpp.1.el6_10, 1.8.0.5.40-1jpp.1.el7, 1.8.0.5.40-3.el8_0
java-1.8.0-ibm-src (Red Hat package) - addressed in versions 1.8.0.5.40-1jpp.1.el6_10, 1.8.0.5.40-1jpp.1.el7, 1.8.0.5.40-3.el8_0
java-1.8.0-ibm-plugin (Red Hat package) - addressed in versions 1.8.0.5.40-1jpp.1.el6_10, 1.8.0.5.40-1jpp.1.el7, 1.8.0.5.40-3.el8_0
java-1.8.0-ibm-jdbc (Red Hat package) - addressed in versions 1.8.0.5.40-1jpp.1.el6_10, 1.8.0.5.40-1jpp.1.el7, 1.8.0.5.40-3.el8_0
java-1.8.0-ibm-demo (Red Hat package) - addressed in versions 1.8.0.5.40-1jpp.1.el6_10, 1.8.0.5.40-1jpp.1.el7, 1.8.0.5.40-3.el8_0
java-1.8.0-ibm-headless (Red Hat package) - update to 1.8.0.5.40-3.el8_0
java-1.8.0-ibm-webstart (Red Hat package) - update to 1.8.0.5.40-3.el8_0

• https://access.redhat.com/errata/RHSA-2019:2585
• https://access.redhat.com/errata/RHSA-2019:2590
• https://access.redhat.com/errata/RHSA-2019:2592
• https://access.redhat.com/errata/RHSA-2019:2737
• https://bugs.eclipse.org/bugs/show_bug.cgi?id=549075

• Multiple vulnerabilities in IBM Cloud Transformation Advisor
• Red Hat Enterprise Linux 7 Supplementary update for java-1.8.0-ibm
• Red Hat Enterprise Linux 8 update for java-1.8.0-ibm
• Red Hat Enterprise Linux 6 Supplementary update for java-1.8.0-ibm
• Red Hat Satellite 5 update for java-1.8.0-ibm