{"id":"CVE-2019-17639","aliases":["EUVD-2019-7949","GHSA-rm33-h23j-qcgg","RHSA-2020:3386","RHSA-2020:3387","RHSA-2020:3388","RHSA-2020:5585","SUSE-SU-2020:14482-1","SUSE-SU-2020:14484-1","SUSE-SU-2020:2453-1","SUSE-SU-2020:2461-1","SUSE-SU-2020:2482-1"],"status":"published","title":"In Eclipse OpenJ9 prior to version 0.21 on Power platforms, calling the System.arraycopy method...","description":"In Eclipse OpenJ9 prior to version 0.21 on Power platforms, calling the System.arraycopy method with a length longer than the length of the source or destination array can, in certain specially crafted code patterns, cause the current method to return prematurely with an undefined return value. This allows whatever value happens to be in the return register at that time to be used as if it matches the method's declared return type.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.01504,"percentile":0.74551,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-843"],"published":"2020-07-15T21:19:31Z","modified":"2026-10-24T10:30:50Z","affected":[{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::supplementary","package":"java-1.8.0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.6.15-1.el8_2"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::supplementary","package":"java-1.8.0-ibm-demo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.6.15-1.el8_2"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::supplementary","package":"java-1.8.0-ibm-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.6.15-1.el8_2"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::supplementary","package":"java-1.8.0-ibm-headless","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.6.15-1.el8_2"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::supplementary","package":"java-1.8.0-ibm-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.6.15-1.el8_2"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::supplementary","package":"java-1.8.0-ibm-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.6.15-1.el8_2"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::supplementary","package":"java-1.8.0-ibm-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.6.15-1.el8_2"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::supplementary","package":"java-1.8.0-ibm-webstart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.6.15-1.el8_2"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_extras:6","package":"java-1.7.1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.7.1.4.70-1jpp.1.el6_10"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_extras:6","package":"java-1.7.1-ibm-demo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.7.1.4.70-1jpp.1.el6_10"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_extras:6","package":"java-1.7.1-ibm-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.7.1.4.70-1jpp.1.el6_10"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_extras:6","package":"java-1.7.1-ibm-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.7.1.4.70-1jpp.1.el6_10"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_extras:6","package":"java-1.7.1-ibm-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.7.1.4.70-1jpp.1.el6_10"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_extras:6","package":"java-1.7.1-ibm-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.7.1.4.70-1jpp.1.el6_10"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_extras:7","package":"java-1.7.1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.7.1.4.70-1jpp.1.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_extras:7","package":"java-1.7.1-ibm-demo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.7.1.4.70-1jpp.1.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_extras:7","package":"java-1.7.1-ibm-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.7.1.4.70-1jpp.1.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_extras:7","package":"java-1.7.1-ibm-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.7.1.4.70-1jpp.1.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_extras:7","package":"java-1.7.1-ibm-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.7.1.4.70-1jpp.1.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_extras:7","package":"java-1.7.1-ibm-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.7.1.4.70-1jpp.1.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_extras:7","package":"java-1.8.0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.6.20-1jpp.1.el7"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:rhel_extras:7","package":"java-1.8.0-ibm-demo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.6.20-1jpp.1.el7"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:rhel_extras:7","package":"java-1.8.0-ibm-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.6.20-1jpp.1.el7"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:rhel_extras:7","package":"java-1.8.0-ibm-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.6.20-1jpp.1.el7"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:rhel_extras:7","package":"java-1.8.0-ibm-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.6.20-1jpp.1.el7"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:rhel_extras:7","package":"java-1.8.0-ibm-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.6.20-1jpp.1.el7"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"java-1_7_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0_sr10.70-65.54.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr4.70-26.58.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP1","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr6.15-3.41.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP2","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr6.15-3.41.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr6.15-3.41.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr6.15-3.41.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr6.15-30.72.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr6.15-30.72.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr6.15-30.72.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr6.15-30.72.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr6.15-30.72.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr6.15-30.72.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr6.15-30.72.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr6.15-30.72.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr6.15-30.72.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr6.15-30.72.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr6.15-30.72.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr6.15-30.72.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr6.15-30.72.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr6.15-30.72.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr6.15-30.72.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr6.15-30.72.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr6.15-30.72.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr4.70-38.56.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr4.70-38.56.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr4.70-38.56.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr4.70-38.56.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr4.70-38.56.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr4.70-38.56.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr4.70-38.56.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr4.70-38.56.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr4.70-38.56.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr4.70-38.56.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr4.70-38.56.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr4.70-38.56.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr4.70-38.56.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr4.70-38.56.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr4.70-38.56.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr4.70-38.56.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr4.70-38.56.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 5","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr4.70-38.56.1"}]}],"bundled":7}],"products":[{"vendor":"eclipse","product":"openj9"},{"vendor":"eclipse foundation","product":"eclipse openj9"},{"vendor":"the eclipse foundation","product":"eclipse openj9"}],"references":[{"url":"https://bugs.eclipse.org/bugs/show_bug.cgi?id=563998","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-17639","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-rm33-h23j-qcgg"},{"url":"https://access.redhat.com/errata/RHSA-2020:3386","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1790556","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1790570","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1856448","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1856784","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1856885","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1856896","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1856988","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1856991","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1856995","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1866497","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3386.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-17639","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-17639","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-2590","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-2590","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-2590","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-2601","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-2601","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-2601","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-14556","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-14556","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-14556","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-14577","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-14577","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-14577","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-14578","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-14578","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-14578","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-14579","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-14579","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-14579","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-14583","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-14583","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-14583","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-14593","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-14593","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-14593","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-14621","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-14621","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-14621","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:3387","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3387.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:3388","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3388.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:5585","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1889271","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1889697","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1889717","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_5585.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-14779","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-14779","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-14779","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-14796","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-14796","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-14796","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-14797","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-14797","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-14797","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-202014482-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1171352","tags":["report"]},{"url":"https://bugzilla.suse.com/1174157","tags":["report"]},{"url":"https://bugzilla.suse.com/1175259","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17639","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14577","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14578","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14579","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14583","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14593","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14621","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-202014484-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20202453-1/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14556","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14581","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20202461-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20202482-1/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2019-17639","description":"In Eclipse OpenJ9 prior to version 0.21 on Power platforms, calling the System.arraycopy method with a length longer than the length of the source or destination array can, in certain specially crafted code patterns, cause the current method to return prematurely with an undefined return value. This allows whatever value happens to be in the return register at that time to be used as if it matches the method's declared return type.","status":"published","published":"2020-07-15T21:19:31Z","modified":"2024-08-05T01:47:13.522Z","cwes":["CWE-843"],"updated_at":"2026-11-02T14:20:24.678649Z"}],"euvd":[{"id":"EUVD-2019-7949","description":"In Eclipse OpenJ9 prior to version 0.21 on Power platforms, calling the System.arraycopy method with a length longer than the length of the source or destination array can, in certain specially crafted code patterns, cause the current method to return prematurely with an undefined return value. This allows whatever value happens to be in the return register at that time to be used as if it matches the method's declared return type.","status":"published","published":"2020-07-15T21:19:31Z","modified":"2024-08-05T01:47:13Z","updated_at":"2026-11-03T02:40:29.306082Z"}],"ghsa":[{"id":"GHSA-rm33-h23j-qcgg","title":"In Eclipse OpenJ9 prior to version 0.21 on Power platforms, calling the System.arraycopy method...","description":"In Eclipse OpenJ9 prior to version 0.21 on Power platforms, calling the System.arraycopy method with a length longer than the length of the source or destination array can, in certain specially crafted code patterns, cause the current method to return prematurely with an undefined return value. This allows whatever value happens to be in the return register at that time to be used as if it matches the method's declared return type.","status":"published","published":"2022-05-24T17:23:42Z","modified":"2023-01-29T05:03:21Z","updated_at":"2026-11-02T14:45:18.070616Z"}],"nvd":[{"id":"CVE-2019-17639","description":"In Eclipse OpenJ9 prior to version 0.21 on Power platforms, calling the System.arraycopy method with a length longer than the length of the source or destination array can, in certain specially crafted code patterns, cause the current method to return prematurely with an undefined return value. This allows whatever value happens to be in the return register at that time to be used as if it matches the method's declared return type.","status":"published","published":"2020-07-15T22:15:13.577Z","modified":"2026-06-17T02:24:19.67Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-843"],"updated_at":"2026-11-02T14:05:47.558959Z"}],"osv":[{"id":"CVE-2019-17639","description":"In Eclipse OpenJ9 prior to version 0.21 on Power platforms, calling the System.arraycopy method with a length longer than the length of the source or destination array can, in certain specially crafted code patterns, cause the current method to return prematurely with an undefined return value. This allows whatever value happens to be in the return register at that time to be used as if it matches the method's declared return type.","status":"published","published":"2020-07-15T22:15:13.577Z","modified":"2026-10-24T10:30:50.436742462Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:11.673963Z"},{"id":"RHSA-2020:3386","title":"Red Hat Security Advisory: java-1.8.0-ibm security update","status":"published","published":"2024-09-13T18:11:02Z","modified":"2026-06-29T10:31:41Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.072948Z"},{"id":"RHSA-2020:3387","title":"Red Hat Security Advisory: java-1.7.1-ibm security update","status":"published","published":"2024-09-13T18:10:51Z","modified":"2026-06-29T10:31:41Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.072948Z"},{"id":"RHSA-2020:3388","title":"Red Hat Security Advisory: java-1.7.1-ibm security update","status":"published","published":"2024-09-13T18:10:43Z","modified":"2026-06-29T10:31:41Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.072948Z"},{"id":"RHSA-2020:5585","title":"Red Hat Security Advisory: java-1.8.0-ibm security update","status":"published","published":"2024-09-13T18:14:25Z","modified":"2026-08-27T10:01:35Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.57369Z"},{"id":"SUSE-SU-2020:14482-1","title":"Security update for java-1_7_0-ibm","description":"This update for java-1_7_0-ibm fixes the following issues:\n\n- Update to Java 7.0 Service Refresh 10 Fix Pack 70 [bsc#1175259, bsc#1174157]\n  CVE-2020-14577 CVE-2020-14578 CVE-2020-14579 CVE-2020-14621\n  CVE-2020-14593 CVE-2020-14583 CVE-2019-17639\n  * Class Libraries:\n    - TRANSLATION MESSAGES UPDATE FOR JCL\n    - UPDATE TIMEZONE INFORMATION TO TZDATA2020A\n  * Security:\n    - CERTIFICATEEXCEPTION OCCURS WHEN FILE.ENCODING PROPERTY SET TO\n      NON DEFAULT VALUE\n\n- The pack200 and unpack200 alternatives should be slaves of java [bsc#1171352]\n","status":"published","published":"2020-09-02T15:11:40Z","modified":"2026-02-04T02:54:16.503718Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"SUSE-SU-2020:14484-1","title":"Security update for java-1_7_1-ibm","description":"This update for java-1_7_1-ibm fixes the following issues:\n\n- Update to Java 7.1 Service Refresh 4 Fix Pack 70 [bsc#1175259, bsc#1174157]\n  CVE-2020-14577 CVE-2020-14578 CVE-2020-14579 CVE-2020-14621\n  CVE-2020-14593 CVE-2020-14583 CVE-2019-17639\n  * Class Libraries:\n    - UPDATE TIMEZONE INFORMATION TO TZDATA2020A\n  * Security:\n    - CERTIFICATEEXCEPTION OCCURS WHEN FILE.ENCODING PROPERTY SET TO\n      NON DEFAULT VALUE\n","status":"published","published":"2020-09-03T10:11:45Z","modified":"2026-02-04T02:20:18.205109Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"SUSE-SU-2020:2453-1","title":"Security update for java-1_8_0-ibm","description":"This update for java-1_8_0-ibm fixes the following issues:\n\n- Update to Java 8.0 Service Refresh 6 Fix Pack 15 [bsc#1175259, bsc#1174157]\n  CVE-2020-14577 CVE-2020-14578 CVE-2020-14579 CVE-2020-14581\n  CVE-2020-14556 CVE-2020-14621 CVE-2020-14593 CVE-2020-14583\n  CVE-2019-17639\n  * Class Libraries:\n    - JAVA.UTIL.ZIP.DEFLATER OPERATIONS THROW JAVA.LANG.INTERNALERROR\n    - JAVA 8 DECODER OBJECTS CONSUME A LARGE AMOUNT OF JAVA HEAP\n    - TRANSLATION MESSAGES UPDATE FOR JCL\n    - UPDATE TIMEZONE INFORMATION TO TZDATA2020A\n  * Java Virtual Machine:\n    - IBM JAVA REGISTERS A HANDLER BY DEFAULT FOR SIGABRT\n    - LARGE MEMORY FOOTPRINT HELD BY TRACECONTEXT OBJECT\n  * JIT Compiler:\n    - CRASH IN THE INTERPRETER AFTER OSR FROM INLINED SYNCHRONIZED METHOD\n      IN DEBUGGING MODE\n    - INTERMITTENT ASSERTION FAILURE REPORTED\n    - CRASH IN RESOLVECLASSREF() DURING AOT LOAD\n    - JIT CRASH DURING CLASS UNLOADING IN J9METHOD_HT::ONCLASSUNLOADING()\n    - SEGMENTATION FAULT WHILE COMPILING A METHOD\n    - UNEXPECTED CLASSCASTEXCEPTION THROWN IN HIGH LEVEL PARALLEL\n      APPLICATION ON IBM Z PLATFORM\n  * Security:\n    - CERTIFICATEEXCEPTION OCCURS WHEN FILE.ENCODING PROPERTY SET TO\n      NON DEFAULT VALUE\n    - CHANGES TO IBMJCE AND IBMJCEPLUS PROVIDERS\n    - IBMJCEPLUS FAILS, WHEN THE SECURITY MANAGER IS ENABLED, WITH\n      DEFAULT PERMISSIONS, SPECIFIED IN JAVA.POLICY FILE\n    - IN CERTAIN INSTANCES, IBMJCEPLUS PROVIDER THROWS EXCEPTION FROM\n      KEYFACTORY CLASS\n","status":"published","published":"2020-09-02T11:59:43Z","modified":"2026-02-04T04:22:46.935586Z","updated_at":"2026-11-02T15:53:48.11786Z"},{"id":"SUSE-SU-2020:2461-1","title":"Security update for java-1_8_0-ibm","description":"This update for java-1_8_0-ibm fixes the following issues:\n\n- Update to Java 8.0 Service Refresh 6 Fix Pack 15 [bsc#1175259, bsc#1174157]\n  CVE-2020-14577 CVE-2020-14578 CVE-2020-14579 CVE-2020-14581\n  CVE-2020-14556 CVE-2020-14621 CVE-2020-14593 CVE-2020-14583\n  CVE-2019-17639\n  * Class Libraries:\n    - JAVA.UTIL.ZIP.DEFLATER OPERATIONS THROW JAVA.LANG.INTERNALERROR\n    - JAVA 8 DECODER OBJECTS CONSUME A LARGE AMOUNT OF JAVA HEAP\n    - TRANSLATION MESSAGES UPDATE FOR JCL\n    - UPDATE TIMEZONE INFORMATION TO TZDATA2020A\n  * Java Virtual Machine:\n    - IBM JAVA REGISTERS A HANDLER BY DEFAULT FOR SIGABRT\n    - LARGE MEMORY FOOTPRINT HELD BY TRACECONTEXT OBJECT\n  * JIT Compiler:\n    - CRASH IN THE INTERPRETER AFTER OSR FROM INLINED SYNCHRONIZED METHOD\n      IN DEBUGGING MODE\n    - INTERMITTENT ASSERTION FAILURE REPORTED\n    - CRASH IN RESOLVECLASSREF() DURING AOT LOAD\n    - JIT CRASH DURING CLASS UNLOADING IN J9METHOD_HT::ONCLASSUNLOADING()\n    - SEGMENTATION FAULT WHILE COMPILING A METHOD\n    - UNEXPECTED CLASSCASTEXCEPTION THROWN IN HIGH LEVEL PARALLEL\n      APPLICATION ON IBM Z PLATFORM\n  * Security:\n    - CERTIFICATEEXCEPTION OCCURS WHEN FILE.ENCODING PROPERTY SET TO\n      NON DEFAULT VALUE\n    - CHANGES TO IBMJCE AND IBMJCEPLUS PROVIDERS\n    - IBMJCEPLUS FAILS, WHEN THE SECURITY MANAGER IS ENABLED, WITH\n      DEFAULT PERMISSIONS, SPECIFIED IN JAVA.POLICY FILE\n    - IN CERTAIN INSTANCES, IBMJCEPLUS PROVIDER THROWS EXCEPTION FROM\n      KEYFACTORY CLASS\n","status":"published","published":"2020-09-02T15:13:35Z","modified":"2026-02-04T04:04:53.267216Z","updated_at":"2026-11-02T15:53:48.11786Z"},{"id":"SUSE-SU-2020:2482-1","title":"Security update for java-1_7_1-ibm","description":"This update for java-1_7_1-ibm fixes the following issues:\n\n- Update to Java 7.1 Service Refresh 4 Fix Pack 70 [bsc#1175259, bsc#1174157]\n  CVE-2020-14577 CVE-2020-14578 CVE-2020-14579 CVE-2020-14621\n  CVE-2020-14593 CVE-2020-14583 CVE-2019-17639\n  * Class Libraries:\n    - UPDATE TIMEZONE INFORMATION TO TZDATA2020A\n  * Security:\n    - CERTIFICATEEXCEPTION OCCURS WHEN FILE.ENCODING PROPERTY SET TO\n      NON DEFAULT VALUE\n","status":"published","published":"2020-09-03T13:22:26Z","modified":"2026-02-04T03:58:34.028917Z","updated_at":"2026-11-02T15:53:48.11786Z"}]}}