Vulnerabilities > Eclipse > Openj9 > 0.14.0
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2019-07-30 | CVE-2019-11775 | Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in multiple products All builds of Eclipse OpenJ9 prior to 0.15 contain a bug where the loop versioner may fail to privatize a value that is pulled out of the loop by versioning - for example if there is a condition that is moved out of the loop that reads a field we may not privatize the value of that field in the modified copy of the loop allowing the test to see one value of the field and subsequently the loop to see a modified field value without retesting the condition moved out of the loop. | 7.4 |
| 2019-07-17 | CVE-2019-11772 | Out-of-bounds Write vulnerability in Eclipse Openj9 In Eclipse OpenJ9 prior to 0.15, the String.getBytes(int, int, byte[], int) method does not verify that the provided byte array is non-null nor that the provided index is in bounds when compiled by the JIT. | 9.8 |
| 2019-07-17 | CVE-2019-11771 | Permissions, Privileges, and Access Controls vulnerability in Eclipse Openj9 AIX builds of Eclipse OpenJ9 before 0.15.0 contain unused RPATHs which may facilitate code injection and privilege elevation by local users. | 7.8 |