CVE-2019-11771

AIX builds of Eclipse OpenJ9 before 0.15.0 contain unused RPATHs which may facilitate code...

7.8 High

AIX builds of Eclipse OpenJ9 before 0.15.0 contain unused RPATHs which may facilitate code injection and privilege elevation by local users.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.39%Up 0.2 points since Apr 14, 2021

What each source reports

NVD Score used 7.8

AIX builds of Eclipse OpenJ9 before 0.15.0 contain unused RPATHs which may facilitate code injection and privilege elevation by local users.

Record: CVE-2019-11771
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 4.6 MediumAV:L/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-264
Updated: 2026-11-02

CVE List No score

AIX builds of Eclipse OpenJ9 before 0.15.0 contain unused RPATHs which may facilitate code injection and privilege elevation by local users.

Record: CVE-2019-11771
Weakness: CWE-264
Updated: 2026-11-02

EUVDEUVD-2019-3439 No score

AIX builds of Eclipse OpenJ9 before 0.15.0 contain unused RPATHs which may facilitate code injection and privilege elevation by local users.

Record: EUVD-2019-3439
Updated: 2026-11-03

GitHub AdvisoriesGHSA-3xjc-j52c-cpx8 7.8

AIX builds of Eclipse OpenJ9 before 0.15.0 contain unused RPATHs which may facilitate code...

AIX builds of Eclipse OpenJ9 before 0.15.0 contain unused RPATHs which may facilitate code injection and privilege elevation by local users.

Record: GHSA-3xjc-j52c-cpx8
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSV 7.8

AIX builds of Eclipse OpenJ9 before 0.15.0 contain unused RPATHs which may facilitate code injection and privilege elevation by local users.

Record: CVE-2019-11771
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVSUSE-SU-2019:14160-1 No score

Security update for java-1_7_1-ibm

This update for java-1_7_1-ibm fixes the following issues:

Update to Java 7.1 Service Refresh 4 Fix Pack 50.

Security issues fixed:

CVE-2019-11771: IBM Security Update July 2019 (bsc#1147021)
CVE-2019-11775: IBM Security Update July 2019 (bsc#1147021)
CVE-2019-4473: IBM Security Update July 2019 (bsc#1147021)
CVE-2019-7317: Fixed issue inside Component AWT (libpng)(bsc#1141780).
CVE-2019-2769: Fixed issue inside Component Utilities (bsc#1141783).
CVE-2019-2762: Fixed issue inside Component Utilities (bsc#1141782).
CVE-2019-2816: Fixed issue inside Component Networking (bsc#1141785).
CVE-2019-2766: Fixed issue inside Component Networking (bsc#1141789).

Record: SUSE-SU-2019:14160-1
Updated: 2026-11-02

Show 4 moreShow less

OSVSUSE-SU-2019:14188-1 No score

Security update for java-1_7_0-ibm

This update for java-1_7_0-ibm fixes the following issues:

Update to Java 7.0 Service Refresh 10 Fix Pack 50 (bsc#1147021).

Security issues fixed:

CVE-2019-2762: Fixed issue inside Component Utilities (bsc#1141782).
CVE-2019-2766: Fixed issue inside Component Networking (bsc#1141789).
CVE-2019-2769: Fixed issue inside Component Utilities (bsc#1141783).
CVE-2019-2816: Fixed issue inside Component Networking (bsc#1147021).
CVE-2019-4473: Fixed insecure RPATH in multiple binaries on AIX (bsc#1147021).
CVE-2019-7317: Fixed use-after-free in libpng, affecting client-libs/java.awt (bsc#1147021).
CVE-2019-11771: Fixed insecure RPATH in OpenJ9 on AIX (bsc#1147021).
CVE-2019-11775: Fixed failure to privatize a value pulled out of the loop by versioning (bsc#1147021).

Record: SUSE-SU-2019:14188-1
Updated: 2026-11-02

OSVSUSE-SU-2019:2291-1 No score

Security update for java-1_8_0-ibm

This update for java-1_8_0-ibm fixes the following issues:

Update to Java 8.0 Service Refresh 5 Fix Pack 40.

Security issues fixed:

CVE-2019-11771: IBM Security Update July 2019 (bsc#1147021)
CVE-2019-11772: IBM Security Update July 2019 (bsc#1147021)
CVE-2019-11775: IBM Security Update July 2019 (bsc#1147021)
CVE-2019-4473: IBM Security Update July 2019 (bsc#1147021)
CVE-2019-7317: Fixed issue inside Component AWT (libpng)(bsc#1141780).
CVE-2019-2769: Fixed issue inside Component Utilities (bsc#1141783).
CVE-2019-2762: Fixed issue inside Component Utilities (bsc#1141782).
CVE-2019-2816: Fixed issue inside Component Networking (bsc#1141785).
CVE-2019-2766: Fixed issue inside Component Networking (bsc#1141789).
CVE-2019-2786: Fixed issue inside Component Security (bsc#1141787).

Record: SUSE-SU-2019:2291-1
Updated: 2026-11-02

OSVSUSE-SU-2019:2336-1 No score

Security update for java-1_7_1-ibm

This update for java-1_7_1-ibm fixes the following issues:

Update to Java 7.1 Service Refresh 4 Fix Pack 50.

Security issues fixed:

CVE-2019-11771: IBM Security Update July 2019 (bsc#1147021)
CVE-2019-11775: IBM Security Update July 2019 (bsc#1147021)
CVE-2019-4473: IBM Security Update July 2019 (bsc#1147021)
CVE-2019-7317: Fixed issue inside Component AWT (libpng)(bsc#1141780).
CVE-2019-2769: Fixed issue inside Component Utilities (bsc#1141783).
CVE-2019-2762: Fixed issue inside Component Utilities (bsc#1141782).
CVE-2019-2816: Fixed issue inside Component Networking (bsc#1141785).
CVE-2019-2766: Fixed issue inside Component Networking (bsc#1141789).

Record: SUSE-SU-2019:2336-1
Updated: 2026-11-02

OSVSUSE-SU-2019:2371-1 No score

Security update for java-1_8_0-ibm

This update for java-1_8_0-ibm fixes the following issues:

Update to Java 8.0 Service Refresh 5 Fix Pack 40.

Security issues fixed:

CVE-2019-11771: IBM Security Update July 2019 (bsc#1147021)
CVE-2019-11772: IBM Security Update July 2019 (bsc#1147021)
CVE-2019-11775: IBM Security Update July 2019 (bsc#1147021)
CVE-2019-4473: IBM Security Update July 2019 (bsc#1147021)
CVE-2019-7317: Fixed issue inside Component AWT (libpng)(bsc#1141780).
CVE-2019-2769: Fixed issue inside Component Utilities (bsc#1141783).
CVE-2019-2762: Fixed issue inside Component Utilities (bsc#1141782).
CVE-2019-2816: Fixed issue inside Component Networking (bsc#1141785).
CVE-2019-2766: Fixed issue inside Component Networking (bsc#1141789).
CVE-2019-2786: Fixed issue inside Component Security (bsc#1141787).

Record: SUSE-SU-2019:2371-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`java-1_7_1-ibm` SUSE:Linux Enterprise Server 11 SP4-LTSS From an advisory covering 8 CVEs	before 1.7.1_sr4.50-26.44.1	1.7.1_sr4.50-26.44.1
`java-1_7_0-ibm` SUSE:Linux Enterprise Point of Sale 11 SP3 From an advisory covering 8 CVEs	before 1.7.0_sr10.50-65.42.1	1.7.0_sr10.50-65.42.1
`java-1_8_0-ibm` SUSE:Linux Enterprise Module for Legacy 15 From an advisory covering 12 CVEs	before 1.8.0_sr5.40-3.24.1	1.8.0_sr5.40-3.24.1
`java-1_8_0-ibm` SUSE:Linux Enterprise Module for Legacy 15 SP1 From an advisory covering 12 CVEs	before 1.8.0_sr5.40-3.24.1	1.8.0_sr5.40-3.24.1
`java-1_7_1-ibm` SUSE:HPE Helion OpenStack 8 From an advisory covering 8 CVEs	before 1.7.1_sr4.50-38.41.1	1.7.1_sr4.50-38.41.1
`java-1_7_1-ibm` SUSE:OpenStack Cloud 7 From an advisory covering 8 CVEs	before 1.7.1_sr4.50-38.41.1	1.7.1_sr4.50-38.41.1
`java-1_7_1-ibm` SUSE:OpenStack Cloud 8 From an advisory covering 8 CVEs	before 1.7.1_sr4.50-38.41.1	1.7.1_sr4.50-38.41.1
`java-1_7_1-ibm` SUSE:OpenStack Cloud Crowbar 8 From an advisory covering 8 CVEs	before 1.7.1_sr4.50-38.41.1	1.7.1_sr4.50-38.41.1
`java-1_7_1-ibm` SUSE:Linux Enterprise Server for SAP Applications 12 SP1 From an advisory covering 8 CVEs	before 1.7.1_sr4.50-38.41.1	1.7.1_sr4.50-38.41.1
`java-1_7_1-ibm` SUSE:Linux Enterprise Server for SAP Applications 12 SP2 From an advisory covering 8 CVEs	before 1.7.1_sr4.50-38.41.1	1.7.1_sr4.50-38.41.1

Show 34 moreShow less

Affected packages
Package	Affected	Fixed
`java-1_7_1-ibm` SUSE:Linux Enterprise Server for SAP Applications 12 SP3 From an advisory covering 8 CVEs	before 1.7.1_sr4.50-38.41.1	1.7.1_sr4.50-38.41.1
`java-1_7_1-ibm` SUSE:Linux Enterprise Software Development Kit 12 SP4 From an advisory covering 8 CVEs	before 1.7.1_sr4.50-38.41.1	1.7.1_sr4.50-38.41.1
`java-1_7_1-ibm` SUSE:Linux Enterprise Software Development Kit 12 SP5 From an advisory covering 8 CVEs	before 1.7.1_sr4.50-38.41.1	1.7.1_sr4.50-38.41.1
`java-1_7_1-ibm` SUSE:Linux Enterprise Server 12 SP1-LTSS From an advisory covering 8 CVEs	before 1.7.1_sr4.50-38.41.1	1.7.1_sr4.50-38.41.1
`java-1_7_1-ibm` SUSE:Linux Enterprise Server 12 SP2-LTSS From an advisory covering 8 CVEs	before 1.7.1_sr4.50-38.41.1	1.7.1_sr4.50-38.41.1
`java-1_7_1-ibm` SUSE:Linux Enterprise Server 12 SP2-BCL From an advisory covering 8 CVEs	before 1.7.1_sr4.50-38.41.1	1.7.1_sr4.50-38.41.1
`java-1_7_1-ibm` SUSE:Linux Enterprise Server 12 SP3-LTSS From an advisory covering 8 CVEs	before 1.7.1_sr4.50-38.41.1	1.7.1_sr4.50-38.41.1
`java-1_7_1-ibm` SUSE:Linux Enterprise Server 12 SP3-BCL From an advisory covering 8 CVEs	before 1.7.1_sr4.50-38.41.1	1.7.1_sr4.50-38.41.1
`java-1_7_1-ibm` SUSE:Linux Enterprise Server 12 SP4 From an advisory covering 8 CVEs	before 1.7.1_sr4.50-38.41.1	1.7.1_sr4.50-38.41.1
`java-1_7_1-ibm` SUSE:Linux Enterprise Server for SAP Applications 12 SP4 From an advisory covering 8 CVEs	before 1.7.1_sr4.50-38.41.1	1.7.1_sr4.50-38.41.1
`java-1_7_1-ibm` SUSE:Linux Enterprise Server 12 SP5 From an advisory covering 8 CVEs	before 1.7.1_sr4.50-38.41.1	1.7.1_sr4.50-38.41.1
`java-1_7_1-ibm` SUSE:Linux Enterprise Server for SAP Applications 12 SP5 From an advisory covering 8 CVEs	before 1.7.1_sr4.50-38.41.1	1.7.1_sr4.50-38.41.1
`java-1_7_1-ibm` SUSE:Enterprise Storage 4 From an advisory covering 8 CVEs	before 1.7.1_sr4.50-38.41.1	1.7.1_sr4.50-38.41.1
`java-1_7_1-ibm` SUSE:Enterprise Storage 5 From an advisory covering 8 CVEs	before 1.7.1_sr4.50-38.41.1	1.7.1_sr4.50-38.41.1
`java-1_8_0-ibm` SUSE:HPE Helion OpenStack 8 From an advisory covering 12 CVEs	before 1.8.0_sr5.40-30.54.1	1.8.0_sr5.40-30.54.1
`java-1_8_0-ibm` SUSE:OpenStack Cloud 7 From an advisory covering 12 CVEs	before 1.8.0_sr5.40-30.54.1	1.8.0_sr5.40-30.54.1
`java-1_8_0-ibm` SUSE:OpenStack Cloud 8 From an advisory covering 12 CVEs	before 1.8.0_sr5.40-30.54.1	1.8.0_sr5.40-30.54.1
`java-1_8_0-ibm` SUSE:OpenStack Cloud Crowbar 8 From an advisory covering 12 CVEs	before 1.8.0_sr5.40-30.54.1	1.8.0_sr5.40-30.54.1
`java-1_8_0-ibm` SUSE:Linux Enterprise Server for SAP Applications 12 SP1 From an advisory covering 12 CVEs	before 1.8.0_sr5.40-30.54.1	1.8.0_sr5.40-30.54.1
`java-1_8_0-ibm` SUSE:Linux Enterprise Server for SAP Applications 12 SP2 From an advisory covering 12 CVEs	before 1.8.0_sr5.40-30.54.1	1.8.0_sr5.40-30.54.1
`java-1_8_0-ibm` SUSE:Linux Enterprise Server for SAP Applications 12 SP3 From an advisory covering 12 CVEs	before 1.8.0_sr5.40-30.54.1	1.8.0_sr5.40-30.54.1
`java-1_8_0-ibm` SUSE:Linux Enterprise Software Development Kit 12 SP4 From an advisory covering 12 CVEs	before 1.8.0_sr5.40-30.54.1	1.8.0_sr5.40-30.54.1
`java-1_8_0-ibm` SUSE:Linux Enterprise Software Development Kit 12 SP5 From an advisory covering 12 CVEs	before 1.8.0_sr5.40-30.54.1	1.8.0_sr5.40-30.54.1
`java-1_8_0-ibm` SUSE:Linux Enterprise Server 12 SP1-LTSS From an advisory covering 12 CVEs	before 1.8.0_sr5.40-30.54.1	1.8.0_sr5.40-30.54.1
`java-1_8_0-ibm` SUSE:Linux Enterprise Server 12 SP2-LTSS From an advisory covering 12 CVEs	before 1.8.0_sr5.40-30.54.1	1.8.0_sr5.40-30.54.1
`java-1_8_0-ibm` SUSE:Linux Enterprise Server 12 SP2-BCL From an advisory covering 12 CVEs	before 1.8.0_sr5.40-30.54.1	1.8.0_sr5.40-30.54.1
`java-1_8_0-ibm` SUSE:Linux Enterprise Server 12 SP3-LTSS From an advisory covering 12 CVEs	before 1.8.0_sr5.40-30.54.1	1.8.0_sr5.40-30.54.1
`java-1_8_0-ibm` SUSE:Linux Enterprise Server 12 SP3-BCL From an advisory covering 12 CVEs	before 1.8.0_sr5.40-30.54.1	1.8.0_sr5.40-30.54.1
`java-1_8_0-ibm` SUSE:Linux Enterprise Server 12 SP4 From an advisory covering 12 CVEs	before 1.8.0_sr5.40-30.54.1	1.8.0_sr5.40-30.54.1
`java-1_8_0-ibm` SUSE:Linux Enterprise Server for SAP Applications 12 SP4 From an advisory covering 12 CVEs	before 1.8.0_sr5.40-30.54.1	1.8.0_sr5.40-30.54.1
`java-1_8_0-ibm` SUSE:Linux Enterprise Server 12 SP5 From an advisory covering 12 CVEs	before 1.8.0_sr5.40-30.54.1	1.8.0_sr5.40-30.54.1
`java-1_8_0-ibm` SUSE:Linux Enterprise Server for SAP Applications 12 SP5 From an advisory covering 12 CVEs	before 1.8.0_sr5.40-30.54.1	1.8.0_sr5.40-30.54.1
`java-1_8_0-ibm` SUSE:Enterprise Storage 4 From an advisory covering 12 CVEs	before 1.8.0_sr5.40-30.54.1	1.8.0_sr5.40-30.54.1
`java-1_8_0-ibm` SUSE:Enterprise Storage 5 From an advisory covering 12 CVEs	before 1.8.0_sr5.40-30.54.1	1.8.0_sr5.40-30.54.1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases, products	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-11771 is a high vulnerability (CVSS 7.8) in Eclipse Openj9, published July 17, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.39%, the 33rd percentile. No source names a fixed version.

References

Show 23 moreShow less