Every CVE Search/ Get API key

CVE-2019-17639

In Eclipse OpenJ9 prior to version 0.21 on Power platforms, calling the System.arraycopy method...

5.3 MediumFix available

In Eclipse OpenJ9 prior to version 0.21 on Power platforms, calling the System.arraycopy method with a length longer than the length of the source or destination array can, in certain specially crafted code patterns, cause the current method to return prematurely with an undefined return value. This allows whatever value happens to be in the return register at that time to be used as if it matches the method's declared return type.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
None

Exploit likelihood

1.50%Up 1.1 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 5.3

In Eclipse OpenJ9 prior to version 0.21 on Power platforms, calling the System.arraycopy method with a length longer than the length of the source or destination array can, in certain specially crafted code patterns, cause the current method to return prematurely with an undefined return value. This allows whatever value happens to be in the return register at that time to be used as if it matches the method's declared return type.

Record
CVE-2019-17639
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
Weakness
CWE-843
Updated
2026-11-02
CVE List No score

In Eclipse OpenJ9 prior to version 0.21 on Power platforms, calling the System.arraycopy method with a length longer than the length of the source or destination array can, in certain specially crafted code patterns, cause the current method to return prematurely with an undefined return value. This allows whatever value happens to be in the return register at that time to be used as if it matches the method's declared return type.

Record
CVE-2019-17639
Weakness
CWE-843
Updated
2026-11-02
EUVDEUVD-2019-7949 No score

In Eclipse OpenJ9 prior to version 0.21 on Power platforms, calling the System.arraycopy method with a length longer than the length of the source or destination array can, in certain specially crafted code patterns, cause the current method to return prematurely with an undefined return value. This allows whatever value happens to be in the return register at that time to be used as if it matches the method's declared return type.

Record
EUVD-2019-7949
Updated
2026-11-03
GitHub AdvisoriesGHSA-rm33-h23j-qcgg No score

In Eclipse OpenJ9 prior to version 0.21 on Power platforms, calling the System.arraycopy method...

In Eclipse OpenJ9 prior to version 0.21 on Power platforms, calling the System.arraycopy method with a length longer than the length of the source or destination array can, in certain specially crafted code patterns, cause the current method to return prematurely with an undefined return value. This allows whatever value happens to be in the return register at that time to be used as if it matches the method's declared return type.

Record
GHSA-rm33-h23j-qcgg
Updated
2026-11-02
OSV 5.3

In Eclipse OpenJ9 prior to version 0.21 on Power platforms, calling the System.arraycopy method with a length longer than the length of the source or destination array can, in certain specially crafted code patterns, cause the current method to return prematurely with an undefined return value. This allows whatever value happens to be in the return register at that time to be used as if it matches the method's declared return type.

Record
CVE-2019-17639
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVRHSA-2020:3386 8.3

Red Hat Security Advisory: java-1.8.0-ibm security update

Record
RHSA-2020:3386
CVSS 3.1
8.3 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Updated
2026-11-02
Show 8 moreShow less
OSVRHSA-2020:3387 8.3

Red Hat Security Advisory: java-1.7.1-ibm security update

Record
RHSA-2020:3387
CVSS 3.1
8.3 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2020:3388 8.3

Red Hat Security Advisory: java-1.7.1-ibm security update

Record
RHSA-2020:3388
CVSS 3.1
8.3 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2020:5585 8.3

Red Hat Security Advisory: java-1.8.0-ibm security update

Record
RHSA-2020:5585
CVSS 3.1
8.3 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVSUSE-SU-2020:14482-1 No score

Security update for java-1_7_0-ibm

This update for java-1_7_0-ibm fixes the following issues:

  • Update to Java 7.0 Service Refresh 10 Fix Pack 70 [bsc#1175259, bsc#1174157] CVE-2020-14577 CVE-2020-14578 CVE-2020-14579 CVE-2020-14621 CVE-2020-14593 CVE-2020-14583 CVE-2019-17639

    • Class Libraries:
      • TRANSLATION MESSAGES UPDATE FOR JCL
      • UPDATE TIMEZONE INFORMATION TO TZDATA2020A
    • Security:
      • CERTIFICATEEXCEPTION OCCURS WHEN FILE.ENCODING PROPERTY SET TO NON DEFAULT VALUE
  • The pack200 and unpack200 alternatives should be slaves of java [bsc#1171352]

Record
SUSE-SU-2020:14482-1
Updated
2026-11-02
OSVSUSE-SU-2020:14484-1 No score

Security update for java-1_7_1-ibm

This update for java-1_7_1-ibm fixes the following issues:

  • Update to Java 7.1 Service Refresh 4 Fix Pack 70 [bsc#1175259, bsc#1174157] CVE-2020-14577 CVE-2020-14578 CVE-2020-14579 CVE-2020-14621 CVE-2020-14593 CVE-2020-14583 CVE-2019-17639
    • Class Libraries:
      • UPDATE TIMEZONE INFORMATION TO TZDATA2020A
    • Security:
      • CERTIFICATEEXCEPTION OCCURS WHEN FILE.ENCODING PROPERTY SET TO NON DEFAULT VALUE
Record
SUSE-SU-2020:14484-1
Updated
2026-11-02
OSVSUSE-SU-2020:2453-1 No score

Security update for java-1_8_0-ibm

This update for java-1_8_0-ibm fixes the following issues:

  • Update to Java 8.0 Service Refresh 6 Fix Pack 15 [bsc#1175259, bsc#1174157] CVE-2020-14577 CVE-2020-14578 CVE-2020-14579 CVE-2020-14581 CVE-2020-14556 CVE-2020-14621 CVE-2020-14593 CVE-2020-14583 CVE-2019-17639
    • Class Libraries:
      • JAVA.UTIL.ZIP.DEFLATER OPERATIONS THROW JAVA.LANG.INTERNALERROR
      • JAVA 8 DECODER OBJECTS CONSUME A LARGE AMOUNT OF JAVA HEAP
      • TRANSLATION MESSAGES UPDATE FOR JCL
      • UPDATE TIMEZONE INFORMATION TO TZDATA2020A
    • Java Virtual Machine:
      • IBM JAVA REGISTERS A HANDLER BY DEFAULT FOR SIGABRT
      • LARGE MEMORY FOOTPRINT HELD BY TRACECONTEXT OBJECT
    • JIT Compiler:
      • CRASH IN THE INTERPRETER AFTER OSR FROM INLINED SYNCHRONIZED METHOD IN DEBUGGING MODE
      • INTERMITTENT ASSERTION FAILURE REPORTED
      • CRASH IN RESOLVECLASSREF() DURING AOT LOAD
      • JIT CRASH DURING CLASS UNLOADING IN J9METHOD_HT::ONCLASSUNLOADING()
      • SEGMENTATION FAULT WHILE COMPILING A METHOD
      • UNEXPECTED CLASSCASTEXCEPTION THROWN IN HIGH LEVEL PARALLEL APPLICATION ON IBM Z PLATFORM
    • Security:
      • CERTIFICATEEXCEPTION OCCURS WHEN FILE.ENCODING PROPERTY SET TO NON DEFAULT VALUE
      • CHANGES TO IBMJCE AND IBMJCEPLUS PROVIDERS
      • IBMJCEPLUS FAILS, WHEN THE SECURITY MANAGER IS ENABLED, WITH DEFAULT PERMISSIONS, SPECIFIED IN JAVA.POLICY FILE
      • IN CERTAIN INSTANCES, IBMJCEPLUS PROVIDER THROWS EXCEPTION FROM KEYFACTORY CLASS
Record
SUSE-SU-2020:2453-1
Updated
2026-11-02
OSVSUSE-SU-2020:2461-1 No score

Security update for java-1_8_0-ibm

This update for java-1_8_0-ibm fixes the following issues:

  • Update to Java 8.0 Service Refresh 6 Fix Pack 15 [bsc#1175259, bsc#1174157] CVE-2020-14577 CVE-2020-14578 CVE-2020-14579 CVE-2020-14581 CVE-2020-14556 CVE-2020-14621 CVE-2020-14593 CVE-2020-14583 CVE-2019-17639
    • Class Libraries:
      • JAVA.UTIL.ZIP.DEFLATER OPERATIONS THROW JAVA.LANG.INTERNALERROR
      • JAVA 8 DECODER OBJECTS CONSUME A LARGE AMOUNT OF JAVA HEAP
      • TRANSLATION MESSAGES UPDATE FOR JCL
      • UPDATE TIMEZONE INFORMATION TO TZDATA2020A
    • Java Virtual Machine:
      • IBM JAVA REGISTERS A HANDLER BY DEFAULT FOR SIGABRT
      • LARGE MEMORY FOOTPRINT HELD BY TRACECONTEXT OBJECT
    • JIT Compiler:
      • CRASH IN THE INTERPRETER AFTER OSR FROM INLINED SYNCHRONIZED METHOD IN DEBUGGING MODE
      • INTERMITTENT ASSERTION FAILURE REPORTED
      • CRASH IN RESOLVECLASSREF() DURING AOT LOAD
      • JIT CRASH DURING CLASS UNLOADING IN J9METHOD_HT::ONCLASSUNLOADING()
      • SEGMENTATION FAULT WHILE COMPILING A METHOD
      • UNEXPECTED CLASSCASTEXCEPTION THROWN IN HIGH LEVEL PARALLEL APPLICATION ON IBM Z PLATFORM
    • Security:
      • CERTIFICATEEXCEPTION OCCURS WHEN FILE.ENCODING PROPERTY SET TO NON DEFAULT VALUE
      • CHANGES TO IBMJCE AND IBMJCEPLUS PROVIDERS
      • IBMJCEPLUS FAILS, WHEN THE SECURITY MANAGER IS ENABLED, WITH DEFAULT PERMISSIONS, SPECIFIED IN JAVA.POLICY FILE
      • IN CERTAIN INSTANCES, IBMJCEPLUS PROVIDER THROWS EXCEPTION FROM KEYFACTORY CLASS
Record
SUSE-SU-2020:2461-1
Updated
2026-11-02
OSVSUSE-SU-2020:2482-1 No score

Security update for java-1_7_1-ibm

This update for java-1_7_1-ibm fixes the following issues:

  • Update to Java 7.1 Service Refresh 4 Fix Pack 70 [bsc#1175259, bsc#1174157] CVE-2020-14577 CVE-2020-14578 CVE-2020-14579 CVE-2020-14621 CVE-2020-14593 CVE-2020-14583 CVE-2019-17639
    • Class Libraries:
      • UPDATE TIMEZONE INFORMATION TO TZDATA2020A
    • Security:
      • CERTIFICATEEXCEPTION OCCURS WHEN FILE.ENCODING PROPERTY SET TO NON DEFAULT VALUE
Record
SUSE-SU-2020:2482-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
java-1.8.0-ibm
Red Hat:enterprise_linux:8::supplementary
before 1:1.8.0.6.15-1.el8_2
1:1.8.0.6.15-1.el8_2
java-1.8.0-ibm-demo
Red Hat:enterprise_linux:8::supplementary
before 1:1.8.0.6.15-1.el8_2
1:1.8.0.6.15-1.el8_2
java-1.8.0-ibm-devel
Red Hat:enterprise_linux:8::supplementary
before 1:1.8.0.6.15-1.el8_2
1:1.8.0.6.15-1.el8_2
java-1.8.0-ibm-headless
Red Hat:enterprise_linux:8::supplementary
before 1:1.8.0.6.15-1.el8_2
1:1.8.0.6.15-1.el8_2
java-1.8.0-ibm-jdbc
Red Hat:enterprise_linux:8::supplementary
before 1:1.8.0.6.15-1.el8_2
1:1.8.0.6.15-1.el8_2
java-1.8.0-ibm-plugin
Red Hat:enterprise_linux:8::supplementary
before 1:1.8.0.6.15-1.el8_2
1:1.8.0.6.15-1.el8_2
java-1.8.0-ibm-src
Red Hat:enterprise_linux:8::supplementary
before 1:1.8.0.6.15-1.el8_2
1:1.8.0.6.15-1.el8_2
java-1.8.0-ibm-webstart
Red Hat:enterprise_linux:8::supplementary
before 1:1.8.0.6.15-1.el8_2
1:1.8.0.6.15-1.el8_2
java-1.7.1-ibm
Red Hat:rhel_extras:6
before 1:1.7.1.4.70-1jpp.1.el6_10
1:1.7.1.4.70-1jpp.1.el6_10
java-1.7.1-ibm-demo
Red Hat:rhel_extras:6
before 1:1.7.1.4.70-1jpp.1.el6_10
1:1.7.1.4.70-1jpp.1.el6_10
Show 57 moreShow less
Affected packages
PackageAffectedFixed
java-1.7.1-ibm-devel
Red Hat:rhel_extras:6
before 1:1.7.1.4.70-1jpp.1.el6_10
1:1.7.1.4.70-1jpp.1.el6_10
java-1.7.1-ibm-jdbc
Red Hat:rhel_extras:6
before 1:1.7.1.4.70-1jpp.1.el6_10
1:1.7.1.4.70-1jpp.1.el6_10
java-1.7.1-ibm-plugin
Red Hat:rhel_extras:6
before 1:1.7.1.4.70-1jpp.1.el6_10
1:1.7.1.4.70-1jpp.1.el6_10
java-1.7.1-ibm-src
Red Hat:rhel_extras:6
before 1:1.7.1.4.70-1jpp.1.el6_10
1:1.7.1.4.70-1jpp.1.el6_10
java-1.7.1-ibm
Red Hat:rhel_extras:7
before 1:1.7.1.4.70-1jpp.1.el7
1:1.7.1.4.70-1jpp.1.el7
java-1.7.1-ibm-demo
Red Hat:rhel_extras:7
before 1:1.7.1.4.70-1jpp.1.el7
1:1.7.1.4.70-1jpp.1.el7
java-1.7.1-ibm-devel
Red Hat:rhel_extras:7
before 1:1.7.1.4.70-1jpp.1.el7
1:1.7.1.4.70-1jpp.1.el7
java-1.7.1-ibm-jdbc
Red Hat:rhel_extras:7
before 1:1.7.1.4.70-1jpp.1.el7
1:1.7.1.4.70-1jpp.1.el7
java-1.7.1-ibm-plugin
Red Hat:rhel_extras:7
before 1:1.7.1.4.70-1jpp.1.el7
1:1.7.1.4.70-1jpp.1.el7
java-1.7.1-ibm-src
Red Hat:rhel_extras:7
before 1:1.7.1.4.70-1jpp.1.el7
1:1.7.1.4.70-1jpp.1.el7
java-1.8.0-ibm
Red Hat:rhel_extras:7
before 1:1.8.0.6.20-1jpp.1.el7
1:1.8.0.6.20-1jpp.1.el7
java-1.8.0-ibm-demo
Red Hat:rhel_extras:7
before 1:1.8.0.6.20-1jpp.1.el7
1:1.8.0.6.20-1jpp.1.el7
java-1.8.0-ibm-devel
Red Hat:rhel_extras:7
before 1:1.8.0.6.20-1jpp.1.el7
1:1.8.0.6.20-1jpp.1.el7
java-1.8.0-ibm-jdbc
Red Hat:rhel_extras:7
before 1:1.8.0.6.20-1jpp.1.el7
1:1.8.0.6.20-1jpp.1.el7
java-1.8.0-ibm-plugin
Red Hat:rhel_extras:7
before 1:1.8.0.6.20-1jpp.1.el7
1:1.8.0.6.20-1jpp.1.el7
java-1.8.0-ibm-src
Red Hat:rhel_extras:7
before 1:1.8.0.6.20-1jpp.1.el7
1:1.8.0.6.20-1jpp.1.el7
java-1_7_0-ibm
SUSE:Linux Enterprise Point of Sale 11 SP3
before 1.7.0_sr10.70-65.54.1
1.7.0_sr10.70-65.54.1
java-1_7_1-ibm
SUSE:Linux Enterprise Server 11 SP4-LTSS
before 1.7.1_sr4.70-26.58.1
1.7.1_sr4.70-26.58.1
java-1_8_0-ibm
SUSE:Linux Enterprise Module for Legacy 15 SP1
before 1.8.0_sr6.15-3.41.1
1.8.0_sr6.15-3.41.1
java-1_8_0-ibm
SUSE:Linux Enterprise Module for Legacy 15 SP2
before 1.8.0_sr6.15-3.41.1
1.8.0_sr6.15-3.41.1
java-1_8_0-ibm
SUSE:Linux Enterprise Server 15-LTSS
before 1.8.0_sr6.15-3.41.1
1.8.0_sr6.15-3.41.1
java-1_8_0-ibm
SUSE:Linux Enterprise Server for SAP Applications 15
before 1.8.0_sr6.15-3.41.1
1.8.0_sr6.15-3.41.1
java-1_8_0-ibm
SUSE:HPE Helion OpenStack 8
before 1.8.0_sr6.15-30.72.1
1.8.0_sr6.15-30.72.1
java-1_8_0-ibm
SUSE:OpenStack Cloud 7
before 1.8.0_sr6.15-30.72.1
1.8.0_sr6.15-30.72.1
java-1_8_0-ibm
SUSE:OpenStack Cloud 8
before 1.8.0_sr6.15-30.72.1
1.8.0_sr6.15-30.72.1
java-1_8_0-ibm
SUSE:OpenStack Cloud 9
before 1.8.0_sr6.15-30.72.1
1.8.0_sr6.15-30.72.1
java-1_8_0-ibm
SUSE:OpenStack Cloud Crowbar 8
before 1.8.0_sr6.15-30.72.1
1.8.0_sr6.15-30.72.1
java-1_8_0-ibm
SUSE:OpenStack Cloud Crowbar 9
before 1.8.0_sr6.15-30.72.1
1.8.0_sr6.15-30.72.1
java-1_8_0-ibm
SUSE:Linux Enterprise Server for SAP Applications 12 SP2
before 1.8.0_sr6.15-30.72.1
1.8.0_sr6.15-30.72.1
java-1_8_0-ibm
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
before 1.8.0_sr6.15-30.72.1
1.8.0_sr6.15-30.72.1
java-1_8_0-ibm
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
before 1.8.0_sr6.15-30.72.1
1.8.0_sr6.15-30.72.1
java-1_8_0-ibm
SUSE:Linux Enterprise Software Development Kit 12 SP5
before 1.8.0_sr6.15-30.72.1
1.8.0_sr6.15-30.72.1
java-1_8_0-ibm
SUSE:Linux Enterprise Server 12 SP2-LTSS
before 1.8.0_sr6.15-30.72.1
1.8.0_sr6.15-30.72.1
java-1_8_0-ibm
SUSE:Linux Enterprise Server 12 SP2-BCL
before 1.8.0_sr6.15-30.72.1
1.8.0_sr6.15-30.72.1
java-1_8_0-ibm
SUSE:Linux Enterprise Server 12 SP3-LTSS
before 1.8.0_sr6.15-30.72.1
1.8.0_sr6.15-30.72.1
java-1_8_0-ibm
SUSE:Linux Enterprise Server 12 SP3-BCL
before 1.8.0_sr6.15-30.72.1
1.8.0_sr6.15-30.72.1
java-1_8_0-ibm
SUSE:Linux Enterprise Server 12 SP4-LTSS
before 1.8.0_sr6.15-30.72.1
1.8.0_sr6.15-30.72.1
java-1_8_0-ibm
SUSE:Linux Enterprise Server 12 SP5
before 1.8.0_sr6.15-30.72.1
1.8.0_sr6.15-30.72.1
java-1_8_0-ibm
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
before 1.8.0_sr6.15-30.72.1
1.8.0_sr6.15-30.72.1
java-1_7_1-ibm
SUSE:HPE Helion OpenStack 8
before 1.7.1_sr4.70-38.56.1
1.7.1_sr4.70-38.56.1
java-1_7_1-ibm
SUSE:OpenStack Cloud 7
before 1.7.1_sr4.70-38.56.1
1.7.1_sr4.70-38.56.1
java-1_7_1-ibm
SUSE:OpenStack Cloud 8
before 1.7.1_sr4.70-38.56.1
1.7.1_sr4.70-38.56.1
java-1_7_1-ibm
SUSE:OpenStack Cloud 9
before 1.7.1_sr4.70-38.56.1
1.7.1_sr4.70-38.56.1
java-1_7_1-ibm
SUSE:OpenStack Cloud Crowbar 8
before 1.7.1_sr4.70-38.56.1
1.7.1_sr4.70-38.56.1
java-1_7_1-ibm
SUSE:OpenStack Cloud Crowbar 9
before 1.7.1_sr4.70-38.56.1
1.7.1_sr4.70-38.56.1
java-1_7_1-ibm
SUSE:Linux Enterprise Server for SAP Applications 12 SP2
before 1.7.1_sr4.70-38.56.1
1.7.1_sr4.70-38.56.1
java-1_7_1-ibm
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
before 1.7.1_sr4.70-38.56.1
1.7.1_sr4.70-38.56.1
java-1_7_1-ibm
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
before 1.7.1_sr4.70-38.56.1
1.7.1_sr4.70-38.56.1
java-1_7_1-ibm
SUSE:Linux Enterprise Software Development Kit 12 SP5
before 1.7.1_sr4.70-38.56.1
1.7.1_sr4.70-38.56.1
java-1_7_1-ibm
SUSE:Linux Enterprise Server 12 SP2-LTSS
before 1.7.1_sr4.70-38.56.1
1.7.1_sr4.70-38.56.1
java-1_7_1-ibm
SUSE:Linux Enterprise Server 12 SP2-BCL
before 1.7.1_sr4.70-38.56.1
1.7.1_sr4.70-38.56.1
java-1_7_1-ibm
SUSE:Linux Enterprise Server 12 SP3-LTSS
before 1.7.1_sr4.70-38.56.1
1.7.1_sr4.70-38.56.1
java-1_7_1-ibm
SUSE:Linux Enterprise Server 12 SP3-BCL
before 1.7.1_sr4.70-38.56.1
1.7.1_sr4.70-38.56.1
java-1_7_1-ibm
SUSE:Linux Enterprise Server 12 SP4-LTSS
before 1.7.1_sr4.70-38.56.1
1.7.1_sr4.70-38.56.1
java-1_7_1-ibm
SUSE:Linux Enterprise Server 12 SP5
before 1.7.1_sr4.70-38.56.1
1.7.1_sr4.70-38.56.1
java-1_7_1-ibm
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
before 1.7.1_sr4.70-38.56.1
1.7.1_sr4.70-38.56.1
java-1_7_1-ibm
SUSE:Enterprise Storage 5
before 1.7.1_sr4.70-38.56.1
1.7.1_sr4.70-38.56.1

History

History
RecordedChangedSources
aliases, productsEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-17639 is a medium vulnerability (CVSS 5.3) in Eclipse Openj9, published July 15, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.50%, the 74th percentile. Fixed in java-1.8.0-ibm 1:1.8.0.6.15-1.el8_2.

References

Show 74 moreShow less
MoveEnter Open