4701 matches found
CVE-2018-12547
The CVE-2018-12547 issue affects Eclipse OpenJ9 where jio_snprintf() and jio_vsnprintf() fail to honor the input length, allowing buffer overflow. IBM advisories corroborate this vulnerability (CVE-2018-12547) within IBM Java SDK/JVM ecosystems and list affected IBM products (SAN Volume Controlle...
CVE-2018-12549
In Eclipse OpenJ9 version 0.11.0, the OpenJ9 JIT compiler may incorrectly omit a null check on the receiver object of an Unsafe call when accelerating it...
CVE-2018-12547
In Eclipse OpenJ9, prior to the 0.12.0 release, the jiosnprintf and jiovsnprintf native methods ignored the length parameter. This affects existing APIs that called the functions to exceed the allocated buffer. This functions were not directly callable by non-native user code...
CVE-2018-12547: Improper Input Validation
In Eclipse OpenJ9, prior to the 0.12.0 release, the jiosnprintf and jiovsnprintf native methods ignored the length parameter. This affects existing APIs that called the functions to exceed the allocated buffer. This functions were not directly callable by non-native user code...
CVE-2018-12549: Direct Use of Unsafe JNI
In Eclipse OpenJ9 version 0.11.0, the OpenJ9 JIT compiler may incorrectly omit a null check on the receiver object of an Unsafe call when accelerating it...
Security Bulletin: IBM i2 Enterprise Insight Analysis. CVE-2018-12539
Summary IBM i2 Enterprise Insight Analysis is delivered with the IBM Java Runtime. A vulnerability was discovered in the IBM Java Runtime that can leave the product vulnerable to attacks allowing arbitrary code to be injected. Vulnerability Details CVEID: CVE-2018-12539 DESCRIPTION: Eclipse OpenJ...
payara -- multiple vulnerabilities
Payara Releases reports: The following is a list of tracked Common Vulnerabilities and Exposures that have been reported and analyzed, which can or have impacted Payara Server across releases: CVE-2018-14721 FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct...
Code injection
In OpenJDK + Eclipse OpenJ9 version 0.11.0 builds, the public jdk.crypto.jniprovider.NativeCrypto class contains public static natives which accept pointer values that are dereferenced in the native code...
CVE-2018-12548
In OpenJDK + Eclipse OpenJ9 version 0.11.0 builds, the public jdk.crypto.jniprovider.NativeCrypto class contains public static natives which accept pointer values that are dereferenced in the native code...
CVE-2018-12548
In OpenJDK + Eclipse OpenJ9 version 0.11.0 builds, the public jdk.crypto.jniprovider.NativeCrypto class contains public static natives which accept pointer values that are dereferenced in the native code...
CVE-2018-12548
In OpenJDK + Eclipse OpenJ9 version 0.11.0 builds, the public jdk.crypto.jniprovider.NativeCrypto class contains public static natives which accept pointer values that are dereferenced in the native code...
CVE-2018-12548
CVE-2018-12548 affects OpenJDK + Eclipse OpenJ9 0.11.0 builds. The issue lies in the public jdk.crypto.jniprovider.NativeCrypto class, which exposes public static native methods that accept pointer values dereferenced in native code, leading to potential fault/impact described by the CVE. Connect...
CVE-2018-12548: Untrusted Pointer Dereference
In OpenJDK + Eclipse OpenJ9 version 0.11.0 builds, the public jdk.crypto.jniprovider.NativeCrypto class contains public static natives which accept pointer values that are dereferenced in the native code...
PT-2019-8895
Name of the Vulnerable Software and Affected Versions OpenJDK + Eclipse OpenJ9 version 0.11.0 Description The issue concerns the public jdk.crypto.jniprovider.NativeCrypto class in OpenJDK + Eclipse OpenJ9, which contains public static natives that accept pointer values. These pointer values are...
PT-2019-5496
Name of the Vulnerable Software and Affected Versions Eclipse Mosquitto versions 1.0 through 1.5.5 Description The issue is related to the authentication procedure in Eclipse Mosquitto. When configured to use a password file for authentication, any malformed data in the file is treated as valid,...
Security Bulletin: Multiple vulnerabilities in IBM Java SDK and IBM Java Runtime affect Rational Functional Tester
Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 7.0.10.30 and Version 8.0.5.20 used by Rational Functional Tester RFT version 8.3.0 - 8.6.0.6 and 8.6.0.7 - 9.2.0.1. RFT has addressed the applicable CVEs. Vulnerability Details Rational Functional Tester has...
Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM MQ
Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ versions 6, 7 and 8 used by IBM MQ. These issues were disclosed as part of the IBM Java SDK updates in July 2018. Vulnerability Details If you run your own Java code using the IBM Java Runtime delivered with this product...
Security Bulletin: Eclipse Jetty is vulnerable to HTTP request smuggling, caused by improper handling of chunked transfer-encoding chunk size. IBM Rational Service Tester is affected by this vulnerability.
Summary Description: Eclipse Jetty is vulnerable to HTTP request smuggling, caused by improper handling of Chunked Transfer-Encoding chunk size. By sending a specially-crafted request, an attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection...
PT-2019-5497
Name of the Vulnerable Software and Affected Versions Eclipse Mosquitto versions 1.0 through 1.5.5 Description The issue is related to insufficient access control in the Eclipse Mosquitto message broker. It may allow a remote attacker to gain unauthorized access to protected information. In certa...
Input validation
Eclipse Mosquitto 1.5.x before 1.5.5 allows ACL bypass: if the option perlistenersettings was set to true, and the default listener was in use, and the default listener specified an aclfile, then the acl file was being ignored...