CVE-2018-12549

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

In Eclipse OpenJ9 version 0.11.0, the OpenJ9 JIT compiler may incorrectly omit a null check on the receiver object of an Unsafe call when accelerating it.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-111 CWE-20

Affected software

Vendor	Product	Versions
The Eclipse Foundation	Eclipse OpenJ9	0.11.0

References

https://access.redhat.com/errata/RHSA-2019:0469Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:0472Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:0640Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1238
https://bugs.eclipse.org/bugs/show_bug.cgi?id=544019Issue Tracking, Mitigation, Vendor Advisory
https://access.redhat.com/errata/RHSA-2019:0469Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:0472Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:0640Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1238
https://bugs.eclipse.org/bugs/show_bug.cgi?id=544019Issue Tracking, Mitigation, Vendor Advisory

Timeline

Published: Feb 11, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-12556.1RSA Identity Lifecycle and Governance versions 7.0.1, 7.0.2 and 7.1.0 contains a reflected cross-site scripting vulnerability. A remote unau CVE-2018-125508.1When Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) is configured to use an ACL file, and that ACL file is empty, or contains only comme CVE-2018-125518.1When Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) is configured to use a password file for authentication, any malformed data in the p CVE-2018-125565.9The signature verification routine in install.sh in yarnpkg/website through 2018-06-05 only verifies that the yarn release is signed by any CVE-2018-125579.8An issue was discovered in Zuul 3.x before 3.1.0. If nodes become offline during the build, the no_log attribute of a task is ignored. If th CVE-2018-125587.5The parse() method in the Email::Address module through 1.909 for Perl is vulnerable to Algorithmic complexity on specially prepared input, CVE-2018-125598.8An issue was discovered in the cantata-mounter D-Bus service in Cantata through 2.3.1. The mount target path check in mounter.cpp `mpOk()` i CVE-2018-12568.1Spring Cloud SSO Connector, version 2.1.2, contains a regression which disables issuer validation in resource servers that are not bound to CVE-2018-125606.5An issue was discovered in the cantata-mounter D-Bus service in Cantata through 2.3.1. Arbitrary unmounts can be performed by regular users CVE-2018-125618.8An issue was discovered in the cantata-mounter D-Bus service in Cantata through 2.3.1. A regular user can inject additional mount options su CVE-2018-125629.8An issue was discovered in the cantata-mounter D-Bus service in Cantata through 2.3.1. The wrapper script 'mount.cifs.wrapper' uses the shel CVE-2018-125636.5An issue was discovered in Linaro LAVA before 2018.5.post1. Because of support for file: URLs, a user can force lava-server-gunicorn to down