CVE-2018-12547
In Eclipse OpenJ9, prior to the 0.12.0 release, the jio_snprintf() and jio_vsnprintf() native...
In Eclipse OpenJ9, prior to the 0.12.0 release, the jio_snprintf() and jio_vsnprintf() native methods ignored the length parameter. This affects existing APIs that called the functions to exceed the allocated buffer. This functions were not directly callable by non-native user code.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
In Eclipse OpenJ9, prior to the 0.12.0 release, the jio_snprintf() and jio_vsnprintf() native methods ignored the length parameter. This affects existing APIs that called the functions to exceed the allocated buffer. This functions were not directly callable by non-native user code.
- Record
CVE-2018-12547- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-20, CWE-119
- Updated
- 2026-11-02
CVE List No score
In Eclipse OpenJ9, prior to the 0.12.0 release, the jio_snprintf() and jio_vsnprintf() native methods ignored the length parameter. This affects existing APIs that called the functions to exceed the allocated buffer. This functions were not directly callable by non-native user code.
- Record
CVE-2018-12547- Weakness
- CWE-20
- Updated
- 2026-11-02
EUVDEUVD-2018-4507 No score
In Eclipse OpenJ9, prior to the 0.12.0 release, the jio_snprintf() and jio_vsnprintf() native methods ignored the length parameter. This affects existing APIs that called the functions to exceed the allocated buffer. This functions were not directly callable by non-native user code.
- Record
EUVD-2018-4507- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5qhh-4q6m-8w7h
In Eclipse OpenJ9, prior to the 0.12.0 release, the jio_snprintf() and jio_vsnprintf() native...
In Eclipse OpenJ9, prior to the 0.12.0 release, the jio_snprintf() and jio_vsnprintf() native methods ignored the length parameter. This affects existing APIs that called the functions to exceed the allocated buffer. This functions were not directly callable by non-native user code.
- Record
GHSA-5qhh-4q6m-8w7h- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-119
- Updated
- 2026-11-02
OSV
In Eclipse OpenJ9, prior to the 0.12.0 release, the jio_snprintf() and jio_vsnprintf() native methods ignored the length parameter. This affects existing APIs that called the functions to exceed the allocated buffer. This functions were not directly callable by non-native user code.
- Record
CVE-2018-12547- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2019:0469
Red Hat Security Advisory: java-1.8.0-ibm security update
- Record
RHSA-2019:0469- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 5 moreShow less
OSVRHSA-2019:0472
Red Hat Security Advisory: java-1.8.0-ibm security update
- Record
RHSA-2019:0472- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2019:0473
Red Hat Security Advisory: java-1.7.1-ibm security update
- Record
RHSA-2019:0473- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2019:0474
Red Hat Security Advisory: java-1.7.1-ibm security update
- Record
RHSA-2019:0474- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2019:0640
Red Hat Security Advisory: java-1.8.0-ibm security update
- Record
RHSA-2019:0640- CVSS 3.0
- 7.3 High
CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2019:1238
Red Hat Security Advisory: java-1.8.0-ibm security update
- Record
RHSA-2019:1238- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
java-1.8.0-ibmRed Hat:rhel_extras:6 From an advisory covering 5 CVEs |
before 1:1.8.0.5.30-1jpp.1.el6_10 | 1:1.8.0.5.30-1jpp.1.el6_10 |
java-1.8.0-ibm-demoRed Hat:rhel_extras:6 From an advisory covering 5 CVEs |
before 1:1.8.0.5.30-1jpp.1.el6_10 | 1:1.8.0.5.30-1jpp.1.el6_10 |
java-1.8.0-ibm-develRed Hat:rhel_extras:6 From an advisory covering 5 CVEs |
before 1:1.8.0.5.30-1jpp.1.el6_10 | 1:1.8.0.5.30-1jpp.1.el6_10 |
java-1.8.0-ibm-jdbcRed Hat:rhel_extras:6 From an advisory covering 5 CVEs |
before 1:1.8.0.5.30-1jpp.1.el6_10 | 1:1.8.0.5.30-1jpp.1.el6_10 |
java-1.8.0-ibm-pluginRed Hat:rhel_extras:6 From an advisory covering 5 CVEs |
before 1:1.8.0.5.30-1jpp.1.el6_10 | 1:1.8.0.5.30-1jpp.1.el6_10 |
java-1.8.0-ibm-srcRed Hat:rhel_extras:6 From an advisory covering 5 CVEs |
before 1:1.8.0.5.30-1jpp.1.el6_10 | 1:1.8.0.5.30-1jpp.1.el6_10 |
java-1.8.0-ibmRed Hat:rhel_extras:7 From an advisory covering 5 CVEs |
before 1:1.8.0.5.30-1jpp.1.el7 | 1:1.8.0.5.30-1jpp.1.el7 |
java-1.8.0-ibm-demoRed Hat:rhel_extras:7 From an advisory covering 5 CVEs |
before 1:1.8.0.5.30-1jpp.1.el7 | 1:1.8.0.5.30-1jpp.1.el7 |
java-1.8.0-ibm-develRed Hat:rhel_extras:7 From an advisory covering 5 CVEs |
before 1:1.8.0.5.30-1jpp.1.el7 | 1:1.8.0.5.30-1jpp.1.el7 |
java-1.8.0-ibm-jdbcRed Hat:rhel_extras:7 From an advisory covering 5 CVEs |
before 1:1.8.0.5.30-1jpp.1.el7 | 1:1.8.0.5.30-1jpp.1.el7 |
Show 24 moreShow less
| Package | Affected | Fixed |
|---|---|---|
java-1.8.0-ibm-pluginRed Hat:rhel_extras:7 From an advisory covering 5 CVEs |
before 1:1.8.0.5.30-1jpp.1.el7 | 1:1.8.0.5.30-1jpp.1.el7 |
java-1.8.0-ibm-srcRed Hat:rhel_extras:7 From an advisory covering 5 CVEs |
before 1:1.8.0.5.30-1jpp.1.el7 | 1:1.8.0.5.30-1jpp.1.el7 |
java-1.7.1-ibmRed Hat:rhel_extras:7 From an advisory covering 3 CVEs |
before 1:1.7.1.4.40-1jpp.1.el7 | 1:1.7.1.4.40-1jpp.1.el7 |
java-1.7.1-ibm-demoRed Hat:rhel_extras:7 From an advisory covering 3 CVEs |
before 1:1.7.1.4.40-1jpp.1.el7 | 1:1.7.1.4.40-1jpp.1.el7 |
java-1.7.1-ibm-develRed Hat:rhel_extras:7 From an advisory covering 3 CVEs |
before 1:1.7.1.4.40-1jpp.1.el7 | 1:1.7.1.4.40-1jpp.1.el7 |
java-1.7.1-ibm-jdbcRed Hat:rhel_extras:7 From an advisory covering 3 CVEs |
before 1:1.7.1.4.40-1jpp.1.el7 | 1:1.7.1.4.40-1jpp.1.el7 |
java-1.7.1-ibm-pluginRed Hat:rhel_extras:7 From an advisory covering 3 CVEs |
before 1:1.7.1.4.40-1jpp.1.el7 | 1:1.7.1.4.40-1jpp.1.el7 |
java-1.7.1-ibm-srcRed Hat:rhel_extras:7 From an advisory covering 3 CVEs |
before 1:1.7.1.4.40-1jpp.1.el7 | 1:1.7.1.4.40-1jpp.1.el7 |
java-1.7.1-ibmRed Hat:rhel_extras:6 From an advisory covering 3 CVEs |
before 1:1.7.1.4.40-1jpp.1.el6_10 | 1:1.7.1.4.40-1jpp.1.el6_10 |
java-1.7.1-ibm-demoRed Hat:rhel_extras:6 From an advisory covering 3 CVEs |
before 1:1.7.1.4.40-1jpp.1.el6_10 | 1:1.7.1.4.40-1jpp.1.el6_10 |
java-1.7.1-ibm-develRed Hat:rhel_extras:6 From an advisory covering 3 CVEs |
before 1:1.7.1.4.40-1jpp.1.el6_10 | 1:1.7.1.4.40-1jpp.1.el6_10 |
java-1.7.1-ibm-jdbcRed Hat:rhel_extras:6 From an advisory covering 3 CVEs |
before 1:1.7.1.4.40-1jpp.1.el6_10 | 1:1.7.1.4.40-1jpp.1.el6_10 |
java-1.7.1-ibm-pluginRed Hat:rhel_extras:6 From an advisory covering 3 CVEs |
before 1:1.7.1.4.40-1jpp.1.el6_10 | 1:1.7.1.4.40-1jpp.1.el6_10 |
java-1.7.1-ibm-srcRed Hat:rhel_extras:6 From an advisory covering 3 CVEs |
before 1:1.7.1.4.40-1jpp.1.el6_10 | 1:1.7.1.4.40-1jpp.1.el6_10 |
java-1.8.0-ibmRed Hat:network_satellite:5.8::el6 From an advisory covering 5 CVEs |
before 1:1.8.0.5.30-1jpp.1.el6_10 | 1:1.8.0.5.30-1jpp.1.el6_10 |
java-1.8.0-ibm-develRed Hat:network_satellite:5.8::el6 From an advisory covering 5 CVEs |
before 1:1.8.0.5.30-1jpp.1.el6_10 | 1:1.8.0.5.30-1jpp.1.el6_10 |
java-1.8.0-ibmRed Hat:enterprise_linux:8::supplementary From an advisory covering 10 CVEs |
before 1:1.8.0.5.35-3.el8_0 | 1:1.8.0.5.35-3.el8_0 |
java-1.8.0-ibm-demoRed Hat:enterprise_linux:8::supplementary From an advisory covering 10 CVEs |
before 1:1.8.0.5.35-3.el8_0 | 1:1.8.0.5.35-3.el8_0 |
java-1.8.0-ibm-develRed Hat:enterprise_linux:8::supplementary From an advisory covering 10 CVEs |
before 1:1.8.0.5.35-3.el8_0 | 1:1.8.0.5.35-3.el8_0 |
java-1.8.0-ibm-headlessRed Hat:enterprise_linux:8::supplementary From an advisory covering 10 CVEs |
before 1:1.8.0.5.35-3.el8_0 | 1:1.8.0.5.35-3.el8_0 |
java-1.8.0-ibm-jdbcRed Hat:enterprise_linux:8::supplementary From an advisory covering 10 CVEs |
before 1:1.8.0.5.35-3.el8_0 | 1:1.8.0.5.35-3.el8_0 |
java-1.8.0-ibm-pluginRed Hat:enterprise_linux:8::supplementary From an advisory covering 10 CVEs |
before 1:1.8.0.5.35-3.el8_0 | 1:1.8.0.5.35-3.el8_0 |
java-1.8.0-ibm-srcRed Hat:enterprise_linux:8::supplementary From an advisory covering 10 CVEs |
before 1:1.8.0.5.35-3.el8_0 | 1:1.8.0.5.35-3.el8_0 |
java-1.8.0-ibm-webstartRed Hat:enterprise_linux:8::supplementary From an advisory covering 10 CVEs |
before 1:1.8.0.5.35-3.el8_0 | 1:1.8.0.5.35-3.el8_0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-12547 is a critical vulnerability (CVSS 9.8) in Eclipse Openj9, published February 11, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.74%, the 86th percentile. No source names a fixed version.
References
access.redhat.com/errata/RHSA-2019:0474
bugs.eclipse.org/bugs/show_bug.cgi?id=543659
Show 51 moreShow less
nvd.nist.gov/vuln/detail/CVE-2018-12547
github.com/advisories/GHSA-5qhh-4q6m-8w7h
bugzilla.redhat.com/show_bug.cgi?id=1579973
security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_0469.json
cve.org/CVERecord?id=CVE-2018-11212
oracle.com/technetwork/security-advisory/cpujan2019-5072801.html