Name: CVE-2023-2597: Buffer Copy without Checking Size of Input
Creator: Rapid7
Published: 2023-05-22T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2023-2597, CWE-120, CWE-125, CVSS 7, EPSS 0.00024

In Eclipse Openj9 before version 0.38.0, in the implementation of the shared cache (which is enabled by default in OpenJ9 builds) the size of a string is not properly checked against the size of the buffer.

CVSS Details

CVSS 3.1 Base Score: 7
CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Ibm Aix	—	Apply the fix or workaround for java_jul2023_advisory	Jul 27, 2023	May 22, 2023
Ibm Java	—	Upgrade IBM Java to version 7.1.5.18Upgrade IBM Java to version 8.0.8.5	Oct 20, 2026	Oct 20, 2026
Suse	—	Upgrade java-1_8_0-ibm-develUpgrade java-1_8_0-ibm-pluginUpgrade java-1_8_0-openj9-develUpgrade java-1_8_0-openj9Upgrade java-1_8_0-openj9-headlessUpgrade java-1_8_0-ibm-32bitUpgrade java-1_8_0-ibm-devel-32bitUpgrade java-1_8_0-ibm-srcUpgrade java-1_8_0-openj9-accessibilityUpgrade java-1_8_0-ibm-alsaUpgrade java-1_8_0-openj9-demoUpgrade java-1_8_0-ibm-demoUpgrade java-1_8_0-openj9-srcUpgrade java-1_8_0-ibmUpgrade java-1_8_0-openj9-javadoc	Jun 12, 2023	May 22, 2023

Prioritize with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business

CVSS Details

Covered by Rapid7

Prioritize with Active Threat Intelligence