CVE-2019-10245

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

In Eclipse OpenJ9 prior to the 0.14.0 release, the Java bytecode verifier incorrectly allows a method to execute past the end of bytecode array causing crashes. Eclipse OpenJ9 v0.14.0 correctly detects this case and rejects the attempted class load.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-20 CWE-119

Affected software

Vendor	Product	Versions
The Eclipse Foundation	Eclipse OpenJ9	>= unspecified, < 0.14.0

References

http://www.securityfocus.com/bid/108094Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2019:1163Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1164Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1165Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1166Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1238Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1325Third Party Advisory
https://bugs.eclipse.org/bugs/show_bug.cgi?id=545588Issue Tracking, Patch, Third Party Advisory
http://www.securityfocus.com/bid/108094Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2019:1163Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1164Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1165Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1166Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1238Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1325Third Party Advisory
https://bugs.eclipse.org/bugs/show_bug.cgi?id=545588Issue Tracking, Patch, Third Party Advisory

Timeline

Published: Apr 19, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-102465.3In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Res CVE-2019-102475.3In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version CVE-2019-102488.1Eclipse Vorto versions prior to 0.11 resolved Maven build artifacts for the Xtext project over HTTP instead of HTTPS. Any of these dependent CVE-2019-102498.1All Xtext & Xtend versions prior to 2.18.0 were built using HTTP instead of HTTPS file transfer and thus the built artifacts may have been c CVE-2019-10256.5A denial of service vulnerability exists when Windows improperly handles objects in memory. An attacker who successfully exploited the vulne CVE-2019-102505.9UCWeb UC Browser 7.0.185.1002 on Windows uses HTTP for downloading certain PDF modules, which allows MITM attacks.CVE-2019-102515.9The UCWeb UC Browser application through 2019-03-26 for Android uses HTTP to download certain modules associated with PDF and Microsoft Offi CVE-2019-102536.5A Cross-Site Request Forgery (CSRF) vulnerability exists in TeamMate+ 21.0.0.0 that allows a remote attacker to modify application data (upl CVE-2019-102546.1In MISP before 2.4.105, the app/View/Layouts/default.ctp default layout template has a Reflected XSS vulnerability.CVE-2019-102556.1An Open Redirect vulnerability for all browsers in Jupyter Notebook before 5.7.7 and some browsers (Chrome, Firefox) in JupyterHub before 0.CVE-2019-102569.8An authentication bypass vulnerability in VIVOTEK IPCam versions prior to 0x13a was found.CVE-2019-102577.5Zucchetti HR Portal through 2019-03-15 allows Directory Traversal. Unauthenticated users can escape outside of the restricted location (dot-