CVE-2020-27221: Buffer Overflow
Eclipse OpenJ9 is vulnerable to a stack-based buffer overflow when the virtual machine or JNI natives are converting from UTF-8 characters to platform encoding. By sending an overly long string, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash.
Other sources
In Eclipse OpenJ9 up to and including version 0.23, there is potential for a stack-based buffer overflow when the virtual machine or JNI natives are converting from UTF-8 characters to platform encoding.
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2020-27221?
CVE-2020-27221 is a vulnerability in Eclipse OpenJ9 that allows a remote attacker to execute arbitrary code or cause application crashes by sending an overly long string.
How severe is CVE-2020-27221?
CVE-2020-27221 has a severity rating of critical, with a severity value of 9 out of 10.
How does CVE-2020-27221 affect Eclipse OpenJ9?
CVE-2020-27221 affects Eclipse OpenJ9 up to and including version 0.23.
How can CVE-2020-27221 be exploited?
CVE-2020-27221 can be exploited by sending an overly long string to the virtual machine or JNI natives when converting from UTF-8 characters to platform encoding.
What is the remedy for CVE-2020-27221?
The remedy for CVE-2020-27221 is to update to the following versions: 1.8.0-ibm-1:1.8.0.6.25-1jpp.1.el7, 1.7.1-ibm-1:1.7.1.4.80-1jpp.1.el7, or 1.8.0-ibm-1:1.8.0.6.25-2.el8_3, depending on the affected software.