CVE-2019-17639
This allows whatever value happens to be in the return register at that time to be used as if it matches the method's declared return type.
Does this matter?
Lower severity and a low EPSS score (1.50%). Track it; it rarely justifies an emergency change on its own.
Description
In Eclipse OpenJ9 prior to version 0.21 on Power platforms, calling the System.arraycopy method with a length longer than the length of the source or destination array can, in certain specially crafted code patterns, cause the current method to return prematurely with an undefined return value. This allows whatever value happens to be in the return register at that time to be used as if it matches the method's declared return type.
- CVSS 3.1
- 5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- EPSS
- 1.50% probability · 73th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-843
- Affected
- eclipse/openj9
- Source
- emo@eclipse.org
References
- https://bugs.eclipse.org/bugs/show_bug.cgi?id=563998Vendor Advisory
- https://bugs.eclipse.org/bugs/show_bug.cgi?id=563998Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.