« Volver al listado

CVE-2019-11774

Estado: ModificadaAlta (7.4)—

Prior to 0.1, all builds of Eclipse OMR contain a bug where the loop versioner may fail to privatize a value that is pulled out of the loop by versioning - for example if there is a condition that is moved out of the loop that reads a field we may not privatize the value of that field in the modified copy of the loop allowing the test to see one value of the field and subsequently the loop to see a modified field value without retesting the condition moved out of the loop. This can lead to a variety of different issues but read out of array bounds is one major consequence of these problems.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Eclipse — OMR

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-11774",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:P",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 4.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.4,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 2.2
      }
    ]
  },
  "affected": [
    {
      "source": "emo@eclipse.org",
      "affectedData": [
        {
          "vendor": "The Eclipse Foundation",
          "product": "Eclipse OMR",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "0.1",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-09-12T18:15:11.850",
  "references": [
    {
      "url": "https://bugs.eclipse.org/bugs/show_bug.cgi?id=549192",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "emo@eclipse.org"
    },
    {
      "url": "https://bugs.eclipse.org/bugs/show_bug.cgi?id=549192",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "emo@eclipse.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-367"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-367"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Prior to 0.1, all builds of Eclipse OMR contain a bug where the loop versioner may fail to privatize a value that is pulled out of the loop by versioning - for example if there is a condition that is moved out of the loop that reads a field we may not privatize the value of that field in the modified copy of the loop allowing the test to see one value of the field and subsequently the loop to see a modified field value without retesting the condition moved out of the loop. This can lead to a variety of different issues but read out of array bounds is one major consequence of these problems."
    },
    {
      "lang": "es",
      "value": "Anterior a la versión 0.1, todas las compilaciones de Eclipse OMR contienen un bug donde el versionador de bucle puede no privatizar un valor que se extrae del bucle para versionado, por ejemplo, si existe una condición que es movida fuera del bucle que lee un campo no podemos privatizar el valor de ese campo en la copia modificada del bucle, permitiendo que la prueba vea un valor del campo y, posteriormente, que el bucle visualice un valor de campo modificado sin volver a probar la condición eliminada del bucle. Esto puede conllevar a una variedad de problemas diferentes, pero una lectura fuera de los límites de la matriz es una consecuencia importante de estos problemas."
    }
  ],
  "lastModified": "2026-06-17T02:13:37.063",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:eclipse:omr:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "71061028-5218-4D4B-8CAB-066BA2E9F2DB",
              "versionEndExcluding": "0.1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "emo@eclipse.org"
}