CoreCVE
Back

MEDIUM

JDK: Information disclosure via calls to System.arraycopy() with invalid length

Published Jul 15, 2020

Description

In Eclipse OpenJ9 prior to version 0.21 on Power platforms, calling the System.arraycopy method with a length longer than the length of the source or destination array can, in certain specially crafted code patterns, cause the current method to return prematurely with an undefined return value. This allows whatever value happens to be in the return register at that time to be used as if it matches the method's declared return type.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-200

Exposure of Sensitive Information

CWE-843

References (5)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner eclipse
Published Jul 15, 2020
Updated Aug 5, 2024
Reserved Oct 16, 2019
Link CVE-2019-17639
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2019-17639
Red Hat
Severity Moderate
Public date Aug 5, 2020
Links CVE-2019-17639 - Bugzilla
ENISA EUVD
Assigner n/a
Published n/a
Updated n/a
Exploited since n/a
Link n/a