Buffer Overflow Vulnerability in Eclipse OpenJ9 Native Methods
CVE-2018-12547
9.8CRITICAL
Key Information:
- Vendor
The Eclipse Foundation
- Status
- Vendor
- CVE Published:
- 11 February 2019
What is CVE-2018-12547?
In Eclipse OpenJ9 prior to version 0.12.0, the jio_snprintf() and jio_vsnprintf() native methods fail to properly enforce the length parameter. This oversight can lead to existing APIs invoking these functions to exceed their allocated buffer size, potentially resulting in buffer overflow vulnerabilities. Although these functions are not directly callable by non-native user code, their misuse through existing APIs poses a risk to application integrity and security.
Affected Version(s)
Eclipse OpenJ9 < 0.12.0