Every CVE Search/ Get API key

CVE-2022-3676

In Eclipse Openj9 before version 0.35.0, interface calls can be inlined without a runtime type...

6.5 MediumFix available

In Eclipse Openj9 before version 0.35.0, interface calls can be inlined without a runtime type check. Malicious bytecode could make use of this inlining to access or modify memory via an incompatible type.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

0.81%Down 0.1 points since Oct 25, 2022
90%50%10%1%

What each source reports

NVD Score used 6.5

In Eclipse Openj9 before version 0.35.0, interface calls can be inlined without a runtime type check. Malicious bytecode could make use of this inlining to access or modify memory via an incompatible type.

Record
CVE-2022-3676
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness
CWE-20, CWE-843
Updated
2026-11-02
CVE List 6.5

In Eclipse Openj9 before version 0.35.0, interface calls can be inlined without a runtime type check. Malicious bytecode could make use of this inlining to access or modify memory via an incompatible type.

Record
CVE-2022-3676
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness
CWE-20, CWE-843
Updated
2026-11-02
EUVDEUVD-2022-43035 6.5

In Eclipse Openj9 before version 0.35.0, interface calls can be inlined without a runtime type check. Malicious bytecode could make use of this inlining to access or modify memory via an incompatible type.

Record
EUVD-2022-43035
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-vw7j-6j6f-vm86 6.5

In Eclipse Openj9 before version 0.35.0, interface calls can be inlined without a runtime type...

In Eclipse Openj9 before version 0.35.0, interface calls can be inlined without a runtime type check. Malicious bytecode could make use of this inlining to access or modify memory via an incompatible type.

Record
GHSA-vw7j-6j6f-vm86
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness
CWE-20, CWE-843
Updated
2026-11-02
OSV 6.5

In Eclipse Openj9 before version 0.35.0, interface calls can be inlined without a runtime type check. Malicious bytecode could make use of this inlining to access or modify memory via an incompatible type.

Record
CVE-2022-3676
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness
CWE-20, CWE-843
Updated
2026-11-02
OSVopenSUSE-SU-2024:12463-1 No score

java-11-openj9-11.0.17.0-1.1 on GA media

These are all security issues fixed in the java-11-openj9-11.0.17.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:12463-1
Updated
2026-11-02
Show 8 moreShow less
OSVopenSUSE-SU-2024:12464-1 No score

java-17-openj9-17.0.5.0-1.1 on GA media

These are all security issues fixed in the java-17-openj9-17.0.5.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:12464-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:12465-1 No score

java-1_8_0-openj9-1.8.0.352-1.1 on GA media

These are all security issues fixed in the java-1_8_0-openj9-1.8.0.352-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:12465-1
Updated
2026-11-02
OSVopenSUSE-SU-2025:0066-1 No score

Security update for java-11-openj9

This update for java-11-openj9 fixes the following issues:

  • Update to OpenJDK 11.0.26 with OpenJ9 0.49.0 virtual machine

  • Including Oracle October 2024 and January 2025 CPU changes

  • Update to OpenJDK 11.0.24 with OpenJ9 0.46.0 virtual machine

  • Including Oracle July 2024 CPU changes

    • CVE-2024-21131 (boo#1228046), CVE-2024-21138 (boo#1228047), CVE-2024-21140 (boo#1228048), CVE-2024-21144 (boo#1228050), CVE-2024-21147 (boo#1228052), CVE-2024-21145 (boo#1228051)
    • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.46/

  • Update to OpenJDK 11.0.23 with OpenJ9 0.44.0 virtual machine

  • Including Oracle April 2024 CPU changes

    • CVE-2024-21012 (boo#1222987), CVE-2024-21094 (boo#1222986), CVE-2024-21011 (boo#1222979), CVE-2024-21085 (boo#1222984), CVE-2024-21068 (boo#1222983)

  • Including OpenJ9/OMR specific fix:

  • Update to OpenJDK 11.0.22 with OpenJ9 0.43.0 virtual machine

  • Including Oracle January 2024 CPU changes

    • CVE-2024-20918 (boo#1218907), CVE-2024-20919 (boo#1218903), CVE-2024-20921 (boo#1218905), CVE-2024-20926 (boo#1218906), CVE-2024-20945 (boo#1218909), CVE-2024-20952 (boo#1218911)
    • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.43/

  • Remove the possibility to put back removes JavaEE modules, since our Java stack does not need this hack any more

  • Update to OpenJDK 11.0.21 with OpenJ9 0.41.0 virtual machine

  • Including Oracle October 2023 CPU changes

    • CVE-2023-22081, boo#1216374

  • Including Openj9 0.41.0 fixes of CVE-2023-5676, boo#1217214

  • Update to OpenJDK 11.0.20.1 with OpenJ9 0.40.0 virtual machine

    • JDK-8313765: Invalid CEN header (invalid zip64 extra data field size)

  • Update to OpenJDK 11.0.20 with OpenJ9 0.40.0 virtual machine

  • Including Oracle April 2023 CPU changes

    • CVE-2023-22006 (boo#1213473), CVE-2023-22036 (boo#1213474), CVE-2023-22041 (boo#1213475), CVE-2023-22045 (boo#1213481), CVE-2023-22049 (boo#1213482), CVE-2023-25193 (boo#1207922)
    • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.40

  • Update to OpenJDK 11.0.19 with OpenJ9 0.38.0 virtual machine

  • Including Oracle April 2023 CPU changes

    • CVE-2023-21930 (boo#1210628), CVE-2023-21937 (boo#1210631), CVE-2023-21938 (boo#1210632), CVE-2023-21939 (boo#1210634), CVE-2023-21954 (boo#1210635), CVE-2023-21967 (boo#1210636), CVE-2023-21968 (boo#1210637)
    • OpenJ9 specific vulnerability: CVE-2023-2597 (boo#1211615)
    • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.38

  • Update to OpenJDK 11.0.18 with OpenJ9 0.36.1 virtual machine

  • Update to OpenJDK 11.0.17 with OpenJ9 0.35.0 virtual machine

    • Including Oracle October 2022 CPU changes CVE-2022-21618 (boo#1204468), CVE-2022-21619 (boo#1204473), CVE-2022-21626 (boo#1204471), CVE-2022-21624 (boo#1204475), CVE-2022-21628 (boo#1204472), CVE-2022-39399 (boo#1204480)
    • Fixes OpenJ9 vulnerability boo#1204703, CVE-2022-3676
    • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.35

  • Update to OpenJDK 11.0.16 with OpenJ9 0.33.0 virtual machine

  • Update to OpenJDK 11.0.15 with OpenJ9…

Record
openSUSE-SU-2025:0066-1
Updated
2026-11-02
OSVopenSUSE-SU-2025:0067-1 No score

Security update for java-17-openj9

This update for java-17-openj9 fixes the following issues:

  • Update to OpenJDK 17.0.14 with OpenJ9 0.49.0 virtual machine

  • Including Oracle October 2024 and January 2025 CPU changes

  • Update to OpenJDK 17.0.12 with OpenJ9 0.46.0 virtual machine

  • Including Oracle July 2024 CPU changes

  • Update to OpenJDK 17.0.11 with OpenJ9 0.44.0 virtual machine

  • Including Oracle April 2024 CPU changes

  • Update to OpenJDK 17.0.10 with OpenJ9 0.43.0 virtual machine

  • Including Oracle January 2024 CPU changes

    • CVE-2024-20918 (boo#1218907), CVE-2024-20919 (boo#1218903), CVE-2024-20921 (boo#1218905), CVE-2024-20932 (boo#1218908), CVE-2024-20945 (boo#1218909), CVE-2024-20952 (boo#1218911)
    • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.43/

  • Update to OpenJDK 17.0.9 with OpenJ9 0.41.0 virtual machine

  • Including Oracle October 2023 CPU changes

    • CVE-2023-22081, boo#1216374
    • CVE-2023-22025, boo#1216339

  • Including Openj9 0.41.0 fixes of CVE-2023-5676, boo#1217214

  • Update to OpenJDK 17.0.8.1 with OpenJ9 0.40.0 virtual machine

    • JDK-8313765: Invalid CEN header (invalid zip64 extra data field size)

  • Update to OpenJDK 17.0.8 with OpenJ9 0.40.0 virtual machine

  • Including Oracle July 2023 CPU changes

    • CVE-2023-22006 (boo#1213473), CVE-2023-22036 (boo#1213474), CVE-2023-22041 (boo#1213475), CVE-2023-22044 (boo#1213479), CVE-2023-22045 (boo#1213481), CVE-2023-22049 (boo#1213482), CVE-2023-25193 (boo#1207922)
    • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.40

  • Update to OpenJDK 17.0.7 with OpenJ9 0.38.0 virtual machine

  • Including Oracle April 2023 CPU changes

    • CVE-2023-21930 (boo#1210628), CVE-2023-21937 (boo#1210631), CVE-2023-21938 (boo#1210632), CVE-2023-21939 (boo#1210634), CVE-2023-21954 (boo#1210635), CVE-2023-21967 (boo#1210636), CVE-2023-21968 (boo#1210637)
    • OpenJ9 specific vulnerability: CVE-2023-2597 (boo#1211615)
    • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.38

  • Update to OpenJDK 17.0.6 with OpenJ9 0.36.0 virtual machine

  • Update to OpenJDK 17.0.5 with OpenJ9 0.35.0 virtual machine

    • Including Oracle October 2022 CPU changes CVE-2022-21618 (boo#1204468), CVE-2022-21619 (boo#1204473), CVE-2022-21626 (boo#1204471), CVE-2022-21624 (boo#1204475), CVE-2022-21628 (boo#1204472), CVE-2022-39399 (boo#1204480)
    • Fixes OpenJ9 vulnerability boo#1204703, CVE-2022-3676
    • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.35
Record
openSUSE-SU-2025:0067-1
Updated
2026-11-02
OSVSUSE-SU-2022:4250-1 No score

Security update for java-1_8_0-openj9

This update for java-1_8_0-openj9 fixes the following issues:

  • Update to OpenJDK 8u352 build 08 with OpenJ9 0.35.0 virtual machine, including Oracle October 2022 CPU changes.

  • CVE-2022-21619: An unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE (bsc#1204473).

  • CVE-2022-21626: An unauthenticated attacker with network access via HTTPS can compromise Oracle Java SE, Oracle GraalVM Enterprise Edition (bsc#1204471).

  • CVE-2022-21624: An unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise (bsc#1204475).

  • CVE-2022-21628: An unauthenticated attacker with network access via HTTP can compromise Oracle Java SE, Oracle GraalVM Enterprise Edition (bsc#1204472).

  • CVE-2022-3676: Fixed interface than calls can be inlined without a runtime type check (bsc#1204703).

Record
SUSE-SU-2022:4250-1
Updated
2026-11-02
OSVSUSE-SU-2022:4591-1 No score

Security update for java-1_7_1-ibm

This update for java-1_7_1-ibm fixes the following issues:

IBM Security Update November 2022: (bsc#1205302, bsc#1204703)

  • CVE-2022-3676: A security vulnerability was fixed in version 7.1.5.15, adding the reference here.
Record
SUSE-SU-2022:4591-1
Updated
2026-11-02
OSVSUSE-SU-2022:4602-1 No score

Security update for java-1_8_0-ibm

This update for java-1_8_0-ibm fixes the following issues:

IBM Security Update November 2022: (bsc#1205302, bsc#1204703)

  • CVE-2022-3676: A security vulnerability was fixed in version 8.0.7.20, adding the reference here.
Record
SUSE-SU-2022:4602-1
Updated
2026-11-02
OSVSUSE-SU-2023:0375-1 No score

Security update for java-1_8_0-ibm

This update for java-1_8_0-ibm fixes the following issues:

IBM Security Update November 2022: (bsc#1205302, bsc#1204703)

  • CVE-2022-3676: A security vulnerability was fixed in version 8.0.7.20, adding the reference here.
Record
SUSE-SU-2023:0375-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
java-1_8_0-openj9
openSUSE:Leap 15.3
From an advisory covering 5 CVEs
 before 1.8.0.352-150200.3.27.1
1.8.0.352-150200.3.27.1
java-1_8_0-openj9
openSUSE:Leap 15.4
From an advisory covering 5 CVEs
 before 1.8.0.352-150200.3.27.1
1.8.0.352-150200.3.27.1
java-1_7_1-ibm
SUSE:OpenStack Cloud 9
 before 1.7.1_sr5.15-38.77.1
1.7.1_sr5.15-38.77.1
java-1_7_1-ibm
SUSE:OpenStack Cloud Crowbar 9
 before 1.7.1_sr5.15-38.77.1
1.7.1_sr5.15-38.77.1
java-1_7_1-ibm
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
 before 1.7.1_sr5.15-38.77.1
1.7.1_sr5.15-38.77.1
java-1_7_1-ibm
SUSE:Linux Enterprise Software Development Kit 12 SP5
 before 1.7.1_sr5.15-38.77.1
1.7.1_sr5.15-38.77.1
java-1_7_1-ibm
SUSE:Linux Enterprise Server 12 SP2-BCL
 before 1.7.1_sr5.15-38.77.1
1.7.1_sr5.15-38.77.1
java-1_7_1-ibm
SUSE:Linux Enterprise Server 12 SP4-LTSS
 before 1.7.1_sr5.15-38.77.1
1.7.1_sr5.15-38.77.1
java-1_7_1-ibm
SUSE:Linux Enterprise Server 12 SP5
 before 1.7.1_sr5.15-38.77.1
1.7.1_sr5.15-38.77.1
java-1_7_1-ibm
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
 before 1.7.1_sr5.15-38.77.1
1.7.1_sr5.15-38.77.1
Show 28 moreShow less
Affected packages
PackageAffectedFixed
java-1_8_0-ibm
SUSE:OpenStack Cloud 9
 before 1.8.0_sr7.20-30.102.1
1.8.0_sr7.20-30.102.1
java-1_8_0-ibm
SUSE:OpenStack Cloud Crowbar 9
 before 1.8.0_sr7.20-30.102.1
1.8.0_sr7.20-30.102.1
java-1_8_0-ibm
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
 before 1.8.0_sr7.20-30.102.1
1.8.0_sr7.20-30.102.1
java-1_8_0-ibm
SUSE:Linux Enterprise Software Development Kit 12 SP5
 before 1.8.0_sr7.20-30.102.1
1.8.0_sr7.20-30.102.1
java-1_8_0-ibm
SUSE:Linux Enterprise Server 12 SP2-BCL
 before 1.8.0_sr7.20-30.102.1
1.8.0_sr7.20-30.102.1
java-1_8_0-ibm
SUSE:Linux Enterprise Server 12 SP4-LTSS
 before 1.8.0_sr7.20-30.102.1
1.8.0_sr7.20-30.102.1
java-1_8_0-ibm
SUSE:Linux Enterprise Server 12 SP5
 before 1.8.0_sr7.20-30.102.1
1.8.0_sr7.20-30.102.1
java-1_8_0-ibm
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
 before 1.8.0_sr7.20-30.102.1
1.8.0_sr7.20-30.102.1
java-1_8_0-ibm
SUSE:Linux Enterprise Module for Legacy 15 SP4
 before 1.8.0_sr7.20-150000.3.68.1
1.8.0_sr7.20-150000.3.68.1
java-1_8_0-ibm
SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS
 before 1.8.0_sr7.20-150000.3.68.1
1.8.0_sr7.20-150000.3.68.1
java-1_8_0-ibm
SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS
 before 1.8.0_sr7.20-150000.3.68.1
1.8.0_sr7.20-150000.3.68.1
java-1_8_0-ibm
SUSE:Linux Enterprise Server 15 SP1-LTSS
 before 1.8.0_sr7.20-150000.3.68.1
1.8.0_sr7.20-150000.3.68.1
java-1_8_0-ibm
SUSE:Linux Enterprise Server 15 SP2-LTSS
 before 1.8.0_sr7.20-150000.3.68.1
1.8.0_sr7.20-150000.3.68.1
java-1_8_0-ibm
SUSE:Linux Enterprise Server 15 SP3-LTSS
 before 1.8.0_sr7.20-150000.3.68.1
1.8.0_sr7.20-150000.3.68.1
java-1_8_0-ibm
SUSE:Linux Enterprise Server for SAP Applications 15 SP1
 before 1.8.0_sr7.20-150000.3.68.1
1.8.0_sr7.20-150000.3.68.1
java-1_8_0-ibm
SUSE:Linux Enterprise Server for SAP Applications 15 SP2
 before 1.8.0_sr7.20-150000.3.68.1
1.8.0_sr7.20-150000.3.68.1
java-1_8_0-ibm
SUSE:Linux Enterprise Server for SAP Applications 15 SP3
 before 1.8.0_sr7.20-150000.3.68.1
1.8.0_sr7.20-150000.3.68.1
java-1_8_0-ibm
SUSE:Enterprise Storage 6
 before 1.8.0_sr7.20-150000.3.68.1
1.8.0_sr7.20-150000.3.68.1
java-1_8_0-ibm
SUSE:Enterprise Storage 7
 before 1.8.0_sr7.20-150000.3.68.1
1.8.0_sr7.20-150000.3.68.1
java-1_8_0-ibm
SUSE:Enterprise Storage 7.1
 before 1.8.0_sr7.20-150000.3.68.1
1.8.0_sr7.20-150000.3.68.1
java-1_8_0-ibm
openSUSE:Leap 15.4
 before 1.8.0_sr7.20-150000.3.68.1
1.8.0_sr7.20-150000.3.68.1
java-11-openj9
openSUSE:Tumbleweed
From an advisory covering 4 CVEs
 before 11.0.17.0-1.1
11.0.17.0-1.1
java-17-openj9
openSUSE:Tumbleweed
From an advisory covering 4 CVEs
 before 17.0.5.0-1.1
17.0.5.0-1.1
java-1_8_0-openj9
openSUSE:Tumbleweed
From an advisory covering 3 CVEs
 before 1.8.0.352-1.1
1.8.0.352-1.1
java-11-openj9
SUSE:Package Hub 15 SP6
From an advisory covering 58 CVEs
 before 11.0.26.0-bp156.4.3.1
11.0.26.0-bp156.4.3.1
java-11-openj9
openSUSE:Leap 15.6
From an advisory covering 58 CVEs
 before 11.0.26.0-bp156.4.3.1
11.0.26.0-bp156.4.3.1
java-17-openj9
SUSE:Package Hub 15 SP6
From an advisory covering 47 CVEs
 before 17.0.14.0-bp156.3.3.1
17.0.14.0-bp156.3.3.1
java-17-openj9
openSUSE:Leap 15.6
From an advisory covering 47 CVEs
 before 17.0.14.0-bp156.3.3.1
17.0.14.0-bp156.3.3.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-3676 is a medium vulnerability (CVSS 6.5) in Eclipse Openj9, published October 24, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.81%, the 57th percentile. Fixed in java-1_7_1-ibm 1.7.1_sr5.15-38.77.1.

References

Show 162 moreShow less
This page doesn't list everything

Left out here: the rest of 1 source description. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open