CVE-2019-17639: 
IBM JDK vulnerability analysis and mitigation

CVE-2019-17639 is a vulnerability discovered in Eclipse OpenJ9 affecting versions prior to 0.21 on Power platforms. The vulnerability involves the System.arraycopy method when called with a length parameter longer than the length of the source or destination array (Eclipse Bug).

The vulnerability is classified as CWE-843, which relates to type confusion where a program allocates or initializes a resource using one type but later accesses it using an incompatible type. In certain specially crafted code patterns, the vulnerability can cause the current method to return prematurely with an undefined return value, allowing whatever value happens to be in the return register to be used as if it matches the method's declared return type (Eclipse Bug).

The vulnerability can lead to information disclosure through calls to System.arraycopy() with invalid length parameters. This could potentially expose sensitive information or lead to unexpected program behavior (Red Hat Advisory).

The vulnerability has been addressed in Eclipse OpenJ9 version 0.21 and later. For affected systems, updates are available through various vendors. Red Hat has released security updates for affected versions of IBM Java SE, including version 7R1 SR4-FP70 and version 8 SR6-FP20. All running instances of IBM Java must be restarted for these updates to take effect (Red Hat Advisory).