Deserialization Vulnerability in Eclipse Memory Analyzer by Eclipse Foundation
CVE-2019-17635

7.8HIGH

Key Information:

Vendor

The Eclipse Foundation

Status
Eclipse Memory Analyzer
Vendor
CVE Published:
17 January 2020

What is CVE-2019-17635?

Eclipse Memory Analyzer versions 1.9.1 and earlier contain a deserialization vulnerability that occurs when an attacker replaces an index file from a parsed heap dump with a malicious version. If a user opens this modified index in the Memory Analyzer, it may lead to code execution on the local system. To mitigate this risk, users should ensure that index files from untrusted sources are removed before reopening heap dumps, and local configuration data must be secured to prevent unauthorized modifications. This vulnerability underlines the importance of careful management of file sources and permissions.

Affected Version(s)

Eclipse Memory Analyzer All versions prior to version 1.9.2

References

https://bugs.eclipse.org/bugs/show_bug.cgi?id=558633
x_refsource_CONFIRM

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.