CVE-2019-11772
In Eclipse OpenJ9 prior to 0.15, the String.getBytes(int, int, byte[], int) method does not...
CVE-2019-11772 is a critical vulnerability (CVSS 9.8) in Eclipse Openj9, published July 17, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.10%, the 81st percentile. Fixed in java-1.8.0-ibm 1:1.8.0.5.40-1jpp.1.el7.
In Eclipse OpenJ9 prior to 0.15, the String.getBytes(int, int, byte[], int) method does not verify that the provided byte array is non-null nor that the provided index is in bounds when compiled by the JIT. This allows arbitrary writes to any 32-bit address or beyond the end of a byte array within Java code run under a SecurityManager.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
In Eclipse OpenJ9 prior to 0.15, the String.getBytes(int, int, byte[], int) method does not verify that the provided byte array is non-null nor that the provided index is in bounds when compiled by the JIT. This allows arbitrary writes to any 32-bit address or beyond the end of a byte array within Java code run under a SecurityManager.
- Record
CVE-2019-11772- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-787
- Updated
- 2026-11-02
CVE List No score
In Eclipse OpenJ9 prior to 0.15, the String.getBytes(int, int, byte[], int) method does not verify that the provided byte array is non-null nor that the provided index is in bounds when compiled by the JIT. This allows arbitrary writes to any 32-bit address or beyond the end of a byte array within Java code run under a SecurityManager.
- Record
CVE-2019-11772- Weakness
- CWE-787
- Updated
- 2026-11-02
EUVDEUVD-2019-3440 No score
In Eclipse OpenJ9 prior to 0.15, the String.getBytes(int, int, byte[], int) method does not verify that the provided byte array is non-null nor that the provided index is in bounds when compiled by the JIT. This allows arbitrary writes to any 32-bit address or beyond the end of a byte array within Java code run under a SecurityManager.
- Record
EUVD-2019-3440- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-pm38-595m-8jp2
In Eclipse OpenJ9 prior to 0.15, the String.getBytes(int, int, byte[], int) method does not...
In Eclipse OpenJ9 prior to 0.15, the String.getBytes(int, int, byte[], int) method does not verify that the provided byte array is non-null nor that the provided index is in bounds when compiled by the JIT. This allows arbitrary writes to any 32-bit address or beyond the end of a byte array within Java code run under a SecurityManager.
- Record
GHSA-pm38-595m-8jp2- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
OSV
In Eclipse OpenJ9 prior to 0.15, the String.getBytes(int, int, byte[], int) method does not verify that the provided byte array is non-null nor that the provided index is in bounds when compiled by the JIT. This allows arbitrary writes to any 32-bit address or beyond the end of a byte array within Java code run under a SecurityManager.
- Record
CVE-2019-11772- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2019:2585
Red Hat Security Advisory: java-1.8.0-ibm security update
- Record
RHSA-2019:2585- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 5 moreShow less
OSVRHSA-2019:2590
Red Hat Security Advisory: java-1.8.0-ibm security update
- Record
RHSA-2019:2590- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2019:2592
Red Hat Security Advisory: java-1.8.0-ibm security update
- Record
RHSA-2019:2592- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2019:2737
Red Hat Security Advisory: java-1.8.0-ibm security update
- Record
RHSA-2019:2737- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVSUSE-SU-2019:2291-1 No score
Security update for java-1_8_0-ibm
This update for java-1_8_0-ibm fixes the following issues:
Update to Java 8.0 Service Refresh 5 Fix Pack 40.
Security issues fixed:
- CVE-2019-11771: IBM Security Update July 2019 (bsc#1147021)
- CVE-2019-11772: IBM Security Update July 2019 (bsc#1147021)
- CVE-2019-11775: IBM Security Update July 2019 (bsc#1147021)
- CVE-2019-4473: IBM Security Update July 2019 (bsc#1147021)
- CVE-2019-7317: Fixed issue inside Component AWT (libpng)(bsc#1141780).
- CVE-2019-2769: Fixed issue inside Component Utilities (bsc#1141783).
- CVE-2019-2762: Fixed issue inside Component Utilities (bsc#1141782).
- CVE-2019-2816: Fixed issue inside Component Networking (bsc#1141785).
- CVE-2019-2766: Fixed issue inside Component Networking (bsc#1141789).
- CVE-2019-2786: Fixed issue inside Component Security (bsc#1141787).
- Record
SUSE-SU-2019:2291-1- Updated
- 2026-11-02
OSVSUSE-SU-2019:2371-1 No score
Security update for java-1_8_0-ibm
This update for java-1_8_0-ibm fixes the following issues:
Update to Java 8.0 Service Refresh 5 Fix Pack 40.
Security issues fixed:
- CVE-2019-11771: IBM Security Update July 2019 (bsc#1147021)
- CVE-2019-11772: IBM Security Update July 2019 (bsc#1147021)
- CVE-2019-11775: IBM Security Update July 2019 (bsc#1147021)
- CVE-2019-4473: IBM Security Update July 2019 (bsc#1147021)
- CVE-2019-7317: Fixed issue inside Component AWT (libpng)(bsc#1141780).
- CVE-2019-2769: Fixed issue inside Component Utilities (bsc#1141783).
- CVE-2019-2762: Fixed issue inside Component Utilities (bsc#1141782).
- CVE-2019-2816: Fixed issue inside Component Networking (bsc#1141785).
- CVE-2019-2766: Fixed issue inside Component Networking (bsc#1141789).
- CVE-2019-2786: Fixed issue inside Component Security (bsc#1141787).
- Record
SUSE-SU-2019:2371-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
java-1.8.0-ibmRed Hat:rhel_extras:7 |
before 1:1.8.0.5.40-1jpp.1.el7 | 1:1.8.0.5.40-1jpp.1.el7 |
java-1.8.0-ibm-demoRed Hat:rhel_extras:7 |
before 1:1.8.0.5.40-1jpp.1.el7 | 1:1.8.0.5.40-1jpp.1.el7 |
java-1.8.0-ibm-develRed Hat:rhel_extras:7 |
before 1:1.8.0.5.40-1jpp.1.el7 | 1:1.8.0.5.40-1jpp.1.el7 |
java-1.8.0-ibm-jdbcRed Hat:rhel_extras:7 |
before 1:1.8.0.5.40-1jpp.1.el7 | 1:1.8.0.5.40-1jpp.1.el7 |
java-1.8.0-ibm-pluginRed Hat:rhel_extras:7 |
before 1:1.8.0.5.40-1jpp.1.el7 | 1:1.8.0.5.40-1jpp.1.el7 |
java-1.8.0-ibm-srcRed Hat:rhel_extras:7 |
before 1:1.8.0.5.40-1jpp.1.el7 | 1:1.8.0.5.40-1jpp.1.el7 |
java-1.8.0-ibmRed Hat:enterprise_linux:8::supplementary |
before 1:1.8.0.5.40-3.el8_0 | 1:1.8.0.5.40-3.el8_0 |
java-1.8.0-ibm-demoRed Hat:enterprise_linux:8::supplementary |
before 1:1.8.0.5.40-3.el8_0 | 1:1.8.0.5.40-3.el8_0 |
java-1.8.0-ibm-develRed Hat:enterprise_linux:8::supplementary |
before 1:1.8.0.5.40-3.el8_0 | 1:1.8.0.5.40-3.el8_0 |
java-1.8.0-ibm-headlessRed Hat:enterprise_linux:8::supplementary |
before 1:1.8.0.5.40-3.el8_0 | 1:1.8.0.5.40-3.el8_0 |
Show 34 moreShow less
| Package | Affected | Fixed |
|---|---|---|
java-1.8.0-ibm-jdbcRed Hat:enterprise_linux:8::supplementary |
before 1:1.8.0.5.40-3.el8_0 | 1:1.8.0.5.40-3.el8_0 |
java-1.8.0-ibm-pluginRed Hat:enterprise_linux:8::supplementary |
before 1:1.8.0.5.40-3.el8_0 | 1:1.8.0.5.40-3.el8_0 |
java-1.8.0-ibm-srcRed Hat:enterprise_linux:8::supplementary |
before 1:1.8.0.5.40-3.el8_0 | 1:1.8.0.5.40-3.el8_0 |
java-1.8.0-ibm-webstartRed Hat:enterprise_linux:8::supplementary |
before 1:1.8.0.5.40-3.el8_0 | 1:1.8.0.5.40-3.el8_0 |
java-1.8.0-ibmRed Hat:rhel_extras:6 |
before 1:1.8.0.5.40-1jpp.1.el6_10 | 1:1.8.0.5.40-1jpp.1.el6_10 |
java-1.8.0-ibm-demoRed Hat:rhel_extras:6 |
before 1:1.8.0.5.40-1jpp.1.el6_10 | 1:1.8.0.5.40-1jpp.1.el6_10 |
java-1.8.0-ibm-develRed Hat:rhel_extras:6 |
before 1:1.8.0.5.40-1jpp.1.el6_10 | 1:1.8.0.5.40-1jpp.1.el6_10 |
java-1.8.0-ibm-jdbcRed Hat:rhel_extras:6 |
before 1:1.8.0.5.40-1jpp.1.el6_10 | 1:1.8.0.5.40-1jpp.1.el6_10 |
java-1.8.0-ibm-pluginRed Hat:rhel_extras:6 |
before 1:1.8.0.5.40-1jpp.1.el6_10 | 1:1.8.0.5.40-1jpp.1.el6_10 |
java-1.8.0-ibm-srcRed Hat:rhel_extras:6 |
before 1:1.8.0.5.40-1jpp.1.el6_10 | 1:1.8.0.5.40-1jpp.1.el6_10 |
java-1.8.0-ibmRed Hat:network_satellite:5.8::el6 |
before 1:1.8.0.5.40-1jpp.1.el6_10 | 1:1.8.0.5.40-1jpp.1.el6_10 |
java-1.8.0-ibm-develRed Hat:network_satellite:5.8::el6 |
before 1:1.8.0.5.40-1jpp.1.el6_10 | 1:1.8.0.5.40-1jpp.1.el6_10 |
java-1_8_0-ibmSUSE:Linux Enterprise Module for Legacy 15 |
before 1.8.0_sr5.40-3.24.1 | 1.8.0_sr5.40-3.24.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Module for Legacy 15 SP1 |
before 1.8.0_sr5.40-3.24.1 | 1.8.0_sr5.40-3.24.1 |
java-1_8_0-ibmSUSE:HPE Helion OpenStack 8 |
before 1.8.0_sr5.40-30.54.1 | 1.8.0_sr5.40-30.54.1 |
java-1_8_0-ibmSUSE:OpenStack Cloud 7 |
before 1.8.0_sr5.40-30.54.1 | 1.8.0_sr5.40-30.54.1 |
java-1_8_0-ibmSUSE:OpenStack Cloud 8 |
before 1.8.0_sr5.40-30.54.1 | 1.8.0_sr5.40-30.54.1 |
java-1_8_0-ibmSUSE:OpenStack Cloud Crowbar 8 |
before 1.8.0_sr5.40-30.54.1 | 1.8.0_sr5.40-30.54.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server for SAP Applications 12 SP1 |
before 1.8.0_sr5.40-30.54.1 | 1.8.0_sr5.40-30.54.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server for SAP Applications 12 SP2 |
before 1.8.0_sr5.40-30.54.1 | 1.8.0_sr5.40-30.54.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server for SAP Applications 12 SP3 |
before 1.8.0_sr5.40-30.54.1 | 1.8.0_sr5.40-30.54.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Software Development Kit 12 SP4 |
before 1.8.0_sr5.40-30.54.1 | 1.8.0_sr5.40-30.54.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Software Development Kit 12 SP5 |
before 1.8.0_sr5.40-30.54.1 | 1.8.0_sr5.40-30.54.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server 12 SP1-LTSS |
before 1.8.0_sr5.40-30.54.1 | 1.8.0_sr5.40-30.54.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server 12 SP2-LTSS |
before 1.8.0_sr5.40-30.54.1 | 1.8.0_sr5.40-30.54.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server 12 SP2-BCL |
before 1.8.0_sr5.40-30.54.1 | 1.8.0_sr5.40-30.54.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server 12 SP3-LTSS |
before 1.8.0_sr5.40-30.54.1 | 1.8.0_sr5.40-30.54.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server 12 SP3-BCL |
before 1.8.0_sr5.40-30.54.1 | 1.8.0_sr5.40-30.54.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server 12 SP4 |
before 1.8.0_sr5.40-30.54.1 | 1.8.0_sr5.40-30.54.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server for SAP Applications 12 SP4 |
before 1.8.0_sr5.40-30.54.1 | 1.8.0_sr5.40-30.54.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server 12 SP5 |
before 1.8.0_sr5.40-30.54.1 | 1.8.0_sr5.40-30.54.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server for SAP Applications 12 SP5 |
before 1.8.0_sr5.40-30.54.1 | 1.8.0_sr5.40-30.54.1 |
java-1_8_0-ibmSUSE:Enterprise Storage 4 |
before 1.8.0_sr5.40-30.54.1 | 1.8.0_sr5.40-30.54.1 |
java-1_8_0-ibmSUSE:Enterprise Storage 5 |
before 1.8.0_sr5.40-30.54.1 | 1.8.0_sr5.40-30.54.1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases, products | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
bugs.eclipse.org/bugs/show_bug.cgi?id=549075
access.redhat.com/errata/RHSA-2019:2585
nvd.nist.gov/vuln/detail/CVE-2019-11772
Show 56 moreShow less
github.com/advisories/GHSA-pm38-595m-8jp2
bugzilla.redhat.com/show_bug.cgi?id=1672409
security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_2585.json
cve.org/CVERecord?id=CVE-2019-2762
suse.com/support/update/announcement/2019/suse-su-20192291-1
bugzilla.suse.com/1122292