CVE-2019-11774

High

Description

Prior to 0.1, all builds of Eclipse OMR contain a bug where the loop versioner may fail to privatize a value that is pulled out of the loop by versioning - for example if there is a condition that is moved out of the loop that reads a field we may not privatize the value of that field in the modified copy of the loop allowing the test to see one value of the field and subsequently the loop to see a modified field value without retesting the condition moved out of the loop. This can lead to a variety of different issues but read out of array bounds is one major consequence of these problems.

SeverityHigh
CVSS7.4
Exploit probability—
ProductEclipse Omr
PublishedSep 12, 2019
First seenSep 12, 2019
Weakness typeCWE-367CWE-367

How to fix

Update
  • eclipse omr0.1 or later

Affected products

ProductAffected versionsFixed in
eclipse omrv < 0.10.1

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.