Daryl Maier

**Name of the Vulnerable Software and Affected Versions** Eclipse OMR versions 0.2.0 through 0.7.9 **Description** An issue exists in the Eclipse OMR port library component where an API function designed to return textual names of supported processor features does not correctly account for separators between these features. If the provided output buffer is incorrectly sized, a buffer overflow can occur. The vulnerable function is the API function to return the textual names of all supported processor features. **Recommendations** Update to Eclipse OMR version 0.8.0 or later.

**Name of the Vulnerable Software and Affected Versions** Eclipse OMR versions prior to 0.5.0 **Description** The issue arises from some internal port library and utilities consumers of z/OS atoe functions in Eclipse OMR not checking their return values for NULL memory pointers or memory allocation failures, potentially leading to NULL pointer dereference crashes. **Recommendations** For Eclipse OMR versions prior to 0.5.0, update to version 0.5.0 or later to ensure that internal consumers of atoe functions correctly handle NULL return values and memory allocation failures.

**Name of the Vulnerable Software and Affected Versions** Eclipse OMR versions 0.2.0 through 0.4.0 **Description** The issue arises from the use of constant length buffers for string conversion in some z/OS atoe print functions. If the input format string and arguments exceed the buffer size, a buffer overflow occurs. This issue is resolved in version 0.5.0, where conversion buffers are correctly sized and checked to prevent overflows. **Recommendations** For Eclipse OMR versions 0.2.0 through 0.4.0, update to version 0.5.0 or later to resolve the issue. As a temporary workaround, consider restricting the input format string and arguments to prevent them from exceeding the buffer size until a patch is available.