Eclipse OMR Buffer Overflow Vulnerability in z/OS Atoe Print Functions

A buffer overflow vulnerability has been identified in Eclipse OMR versions 0.2.0 prior to 0.4.0. The issue arises in some z/OS atoe print functions that utilize a constant length buffer for string conversion. When the input format string and arguments exceed the buffer size, a buffer overflow occurs. This vulnerability has been addressed in version 0.5.0, where the conversion buffers are now properly sized and checked to prevent such overflows.

Impact

Exploitation of this vulnerability leads to a buffer overflow, which can commonly result in arbitrary code execution or causing a program to crash.

Remediation

Users can upgrade to Eclipse OMR version 0.5.0 or later, where this vulnerability has been fixed.