CVE-2018-1656 The IBM Java Runtime Environment's Diagnostic Tooling Framework for Java (DTFJ) (IBM SDK, Java Technology Edition 6.0 , 7.0, and 8.0) does not protect against path traversal attacks when extracting co...
MediumCVSS 6.5
EPSS 4.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The IBM Java Runtime Environment's Diagnostic Tooling Framework for Java (DTFJ) (IBM SDK, Java Technology Edition 6.0 , 7.0, and 8.0) does not protect against path traversal attacks when extracting compressed dump files. IBM X-Force ID: 144882.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ibm sdk | = 6.0 | No fix listed |
| ibm sdk | = 7.0 | No fix listed |
| ibm sdk | = 8.0 | No fix listed |
| redhat satellite | = 5.6 | No fix listed |
| redhat satellite | = 5.7 | No fix listed |
| redhat satellite | = 5.8 | No fix listed |
| redhat enterprise linux desktop | = 6.0 | No fix listed |
| redhat enterprise linux desktop | = 7.0 | No fix listed |
| redhat enterprise linux server | = 6.0 | No fix listed |
| redhat enterprise linux server | = 7.0 | No fix listed |
| redhat enterprise linux workstation | = 6.0 | No fix listed |
| redhat enterprise linux workstation | = 7.0 | No fix listed |
| oracle enterprise manager base platform | = 13.2.0.0.0 | No fix listed |
| oracle enterprise manager base platform | = 13.3.0.0.0 | No fix listed |
| ibm SDK, Java Technology Edition | = 6.0 | No fix listed |
| ibm SDK, Java Technology Edition | = 7.0 | No fix listed |
| ibm SDK, Java Technology Edition | = 8.0 | No fix listed |
References
- www.ibm.com vendor-advisory
- 105118 third-party-advisory vdb-entry
- 1041765 third-party-advisory vdb-entry
- RHSA-2018:2568 third-party-advisory vendor-advisory
- RHSA-2018:2569 third-party-advisory vendor-advisory
- RHSA-2018:2575 third-party-advisory vendor-advisory
- RHSA-2018:2576 third-party-advisory vendor-advisory
- RHSA-2018:2712 third-party-advisory vendor-advisory
- RHSA-2018:2713 third-party-advisory vendor-advisory
- ibm-java-cve20181656-file-overwrite(144882) vdb-entry vendor-advisory
- www.oracle.com patch third-party-advisory