Andrew Johnson

Name of the Vulnerable Software and Affected Versions: Eclipse Platform versions 4.18 and earlier Description: The Help Subsystem in the Eclipse Platform does not authenticate active help requests to the local help web server. This allows an unauthenticated local attacker to issue active help commands to the associated Eclipse Platform process or Eclipse Rich Client Platform process. Recommendations: For versions 4.18 and earlier, consider disabling the Help Subsystem until a patch is available to prevent unauthorized access to the local help web server. Restrict access to the local help web server to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Eclipse Memory Analyzer versions 1.9.1 and earlier **Description** The issue concerns a deserialization vulnerability. It can occur if an index file of a parsed heap dump is replaced with a malicious version and the heap dump is reopened in Memory Analyzer. The user must choose to reopen an already parsed heap dump with an untrusted index for the problem to occur. Additionally, some local configuration data is subject to a deserialization vulnerability if the local data were to be replaced with a malicious version. This can be averted if the local configuration data stored on the file system cannot be changed by an attacker. The vulnerability could possibly allow code execution on the local system. **Recommendations** For Eclipse Memory Analyzer versions 1.9.1 and earlier, to avert the problem, delete index files from untrusted sources and open and reparse the heap dump. Ensure local configuration data stored on the file system cannot be changed by an attacker.