Description
All builds of Eclipse OpenJ9 prior to 0.15 contain a bug where the loop versioner may fail to privatize a value that is pulled out of the loop by versioning - for example if there is a condition that is moved out of the loop that reads a field we may not privatize the value of that field in the modified copy of the loop allowing the test to see one value of the field and subsequently the loop to see a modified field value without retesting the condition moved out of the loop. This can lead to a variety of different issues but read out of array bounds is one major consequence of these problems.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| The Eclipse Foundation | Eclipse OpenJ9 | unspecified – < 0.15.0 | 0.15.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | java-1.8.0-ibm +7 | 1:1.8.0.5.40-3.el8_0 | RHSA-2019:2590 |
| RHEL 7 | java-1.7.1-ibm +5 | 1:1.7.1.4.50-1jpp.1.el7 | RHSA-2019:2495 |
| RHEL 7 | java-1.8.0-ibm +5 | 1:1.8.0.5.40-1jpp.1.el7 | RHSA-2019:2585 |
| RHEL 6 | java-1.7.1-ibm +5 | 1:1.7.1.4.50-1jpp.1.el6_10 | RHSA-2019:2494 |
| RHEL 6 | java-1.8.0-ibm +5 | 1:1.8.0.5.40-1jpp.1.el6_10 | RHSA-2019:2592 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Network Satellite 5 | java-1.8.0-ibm +1 | 1:1.8.0.5.40-1jpp.1.el6_10 | RHSA-2019:2737 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP1 | java-1_8_0-ibm | 1.8.0_sr5.40-3.24.1 | SUSE-SU-2019:2291-1 |
| SLES 15 | java-1_8_0-ibm | 1.8.0_sr5.40-3.24.1 | SUSE-SU-2019:2291-1 |
| SLES 12 SP5 | java-1_7_1-ibm | 1.7.1_sr4.50-38.41.1 | SUSE-SU-2019:2336-1 |
| SLES 12 SP5 | java-1_8_0-ibm | 1.8.0_sr5.40-30.54.1 | SUSE-SU-2019:2371-1 |
| SLES 12 SP4 | java-1_7_1-ibm | 1.7.1_sr4.50-38.41.1 | SUSE-SU-2019:2336-1 |
| SLES 12 SP4 | java-1_8_0-ibm | 1.8.0_sr5.40-30.54.1 | SUSE-SU-2019:2371-1 |
| SLES 12 SP3 | java-1_7_1-ibm | 1.7.1_sr4.50-38.41.1 | SUSE-SU-2019:2336-1 |
| SLES 12 SP3 | java-1_8_0-ibm | 1.8.0_sr5.40-30.54.1 | SUSE-SU-2019:2371-1 |
Show 15 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP2 | java-1_7_1-ibm | 1.7.1_sr4.50-38.41.1 | SUSE-SU-2019:2336-1 |
| SLES 12 SP2 | java-1_8_0-ibm | 1.8.0_sr5.40-30.54.1 | SUSE-SU-2019:2371-1 |
| SLES 12 SP1 | java-1_7_1-ibm | 1.7.1_sr4.50-38.41.1 | SUSE-SU-2019:2336-1 |
| SLES 12 SP1 | java-1_8_0-ibm | 1.8.0_sr5.40-30.54.1 | SUSE-SU-2019:2371-1 |
| SLES 11 SP4 | java-1_7_1-ibm | 1.7.1_sr4.50-26.44.1 | SUSE-SU-2019:14160-1 |
| SLES for SAP 12 SP5 | java-1_7_1-ibm | 1.7.1_sr4.50-38.41.1 | SUSE-SU-2019:2336-1 |
| SLES for SAP 12 SP5 | java-1_8_0-ibm | 1.8.0_sr5.40-30.54.1 | SUSE-SU-2019:2371-1 |
| SLES for SAP 12 SP4 | java-1_7_1-ibm | 1.7.1_sr4.50-38.41.1 | SUSE-SU-2019:2336-1 |
| SLES for SAP 12 SP4 | java-1_8_0-ibm | 1.8.0_sr5.40-30.54.1 | SUSE-SU-2019:2371-1 |
| SLES for SAP 12 SP3 | java-1_7_1-ibm | 1.7.1_sr4.50-38.41.1 | SUSE-SU-2019:2336-1 |
| SLES for SAP 12 SP3 | java-1_8_0-ibm | 1.8.0_sr5.40-30.54.1 | SUSE-SU-2019:2371-1 |
| SLES for SAP 12 SP2 | java-1_7_1-ibm | 1.7.1_sr4.50-38.41.1 | SUSE-SU-2019:2336-1 |
| SLES for SAP 12 SP2 | java-1_8_0-ibm | 1.8.0_sr5.40-30.54.1 | SUSE-SU-2019:2371-1 |
| SLES for SAP 12 SP1 | java-1_7_1-ibm | 1.7.1_sr4.50-38.41.1 | SUSE-SU-2019:2336-1 |
| SLES for SAP 12 SP1 | java-1_8_0-ibm | 1.8.0_sr5.40-30.54.1 | SUSE-SU-2019:2371-1 |
| SUSE OpenStack Cloud Crowbar 8 | java-1_7_1-ibm | 1.7.1_sr4.50-38.41.1 | SUSE-SU-2019:2336-1 |
| SUSE OpenStack Cloud Crowbar 8 | java-1_8_0-ibm | 1.8.0_sr5.40-30.54.1 | SUSE-SU-2019:2371-1 |
| SUSE OpenStack Cloud 8 | java-1_7_1-ibm | 1.7.1_sr4.50-38.41.1 | SUSE-SU-2019:2336-1 |
| SUSE OpenStack Cloud 8 | java-1_8_0-ibm | 1.8.0_sr5.40-30.54.1 | SUSE-SU-2019:2371-1 |
| SUSE OpenStack Cloud 7 | java-1_7_1-ibm | 1.7.1_sr4.50-38.41.1 | SUSE-SU-2019:2336-1 |
| SUSE OpenStack Cloud 7 | java-1_8_0-ibm | 1.8.0_sr5.40-30.54.1 | SUSE-SU-2019:2371-1 |
| SUSE Linux Enterprise Point of Sale 11 SP3 | java-1_7_0-ibm | 1.7.0_sr10.50-65.42.1 | SUSE-SU-2019:14188-1 |
| SUSE HPE Helion OpenStack 8 | java-1_7_1-ibm | 1.7.1_sr4.50-38.41.1 | SUSE-SU-2019:2336-1 |
| SUSE HPE Helion OpenStack 8 | java-1_8_0-ibm | 1.8.0_sr5.40-30.54.1 | SUSE-SU-2019:2371-1 |
| SUSE Enterprise Storage 5 | java-1_7_1-ibm | 1.7.1_sr4.50-38.41.1 | SUSE-SU-2019:2336-1 |
| SUSE Enterprise Storage 5 | java-1_8_0-ibm | 1.8.0_sr5.40-30.54.1 | SUSE-SU-2019:2371-1 |
| SUSE Enterprise Storage 4 | java-1_7_1-ibm | 1.7.1_sr4.50-38.41.1 | SUSE-SU-2019:2336-1 |
| SUSE Enterprise Storage 4 | java-1_8_0-ibm | 1.8.0_sr5.40-30.54.1 | SUSE-SU-2019:2371-1 |
Advisories 11
- RHSA-2019:2737 Red Hat Security Advisory: java-1.8.0-ibm security update Red Hat Security Advisories (RHSA) · Aug 27, 2026
- RHSA-2019:2592 Red Hat Security Advisory: java-1.8.0-ibm security update Red Hat Security Advisories (RHSA) · Aug 27, 2026
- RHSA-2019:2585 Red Hat Security Advisory: java-1.8.0-ibm security update Red Hat Security Advisories (RHSA) · Aug 27, 2026
- RHSA-2019:2590 Red Hat Security Advisory: java-1.8.0-ibm security update Red Hat Security Advisories (RHSA) · Aug 27, 2026
- RHSA-2019:2494 Red Hat Security Advisory: java-1.7.1-ibm security update Red Hat Security Advisories (RHSA) · Aug 27, 2026
- RHSA-2019:2495 Red Hat Security Advisory: java-1.7.1-ibm security update Red Hat Security Advisories (RHSA) · Aug 27, 2026
- SUSE-SU-2019:2291-1 Security update for java-1_8_0-ibm SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:2336-1 Security update for java-1_7_1-ibm SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:2371-1 Security update for java-1_8_0-ibm SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:14160-1 Security update for java-1_7_1-ibm SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:14188-1 Security update for java-1_7_0-ibm SUSE / openSUSE Security Updates · May 2, 2025
References
- https://bugs.eclipse.org/bugs/show_bug.cgi?id=549601
- RHSA-2019:2494 vendor-advisory
- RHSA-2019:2495 vendor-advisory
- RHSA-2019:2585 vendor-advisory
- RHSA-2019:2590 vendor-advisory
- RHSA-2019:2592 vendor-advisory
- RHSA-2019:2737 vendor-advisory