Description
The IBM Java Runtime Environment's Diagnostic Tooling Framework for Java (DTFJ) (IBM SDK, Java Technology Edition 6.0 , 7.0, and 8.0) does not protect against path traversal attacks when extracting compressed dump files. IBM X-Force ID: 144882.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| IBM | SDK, Java Technology Edition | 6.0, 7.0, 8.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | java-1.7.1-ibm +5 | 1:1.7.1.4.30-1jpp.1.el7 | RHSA-2018:2569 |
| RHEL 7 | java-1.8.0-ibm +5 | 1:1.8.0.5.20-1jpp.1.el7 | RHSA-2018:2568 |
| RHEL 6 | java-1.7.1-ibm +5 | 1:1.7.1.4.30-1jpp.2.el6_10 | RHSA-2018:2576 |
| RHEL 6 | java-1.8.0-ibm +5 | 1:1.8.0.5.20-1jpp.1.el6_10 | RHSA-2018:2575 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Network Satellite 5 | java-1.7.1-ibm +1 | 1:1.7.1.4.30-1jpp.2.el6_10 | RHSA-2018:2712 |
| Red Hat Network Satellite 5 | java-1.8.0-ibm +1 | 1:1.8.0.5.20-1jpp.1.el6_10 | RHSA-2018:2713 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 | java-1_8_0-ibm | 1.8.0_sr5.20-3.6.2 | SUSE-SU-2018:3082-1 |
| SLES 12 SP3 | java-1_7_1-ibm | 1.7.1_sr4.30-38.26.1 | SUSE-SU-2018:2649-1 |
| SLES 12 SP3 | java-1_8_0-ibm | 1.8.0_sr5.20-30.36.1 | SUSE-SU-2018:2839-1 |
| SLES 12 SP2 | java-1_7_1-ibm | 1.7.1_sr4.30-38.26.1 | SUSE-SU-2018:2649-2, SUSE-SU-2018:2649-1 |
| SLES 12 SP2 | java-1_8_0-ibm | 1.8.0_sr5.20-30.36.1 | SUSE-SU-2018:2839-2, SUSE-SU-2018:2839-1 |
| SLES 12 SP1 | java-1_7_1-ibm | 1.7.1_sr4.30-38.26.1 | SUSE-SU-2018:2649-1 |
| SLES 12 SP1 | java-1_8_0-ibm | 1.8.0_sr5.20-30.36.1 | SUSE-SU-2018:2839-1 |
| SLES 12 | java-1_7_1-ibm | 1.7.1_sr4.30-38.26.1 | SUSE-SU-2018:2649-1 |
Show 9 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 11 SP4 | java-1_7_1-ibm | 1.7.1_sr4.30-26.29.1 | SUSE-SU-2018:2583-1 |
| SLES 11 SP3 | java-1_7_0-ibm | 1.7.0_sr10.30-65.28.1 | SUSE-SU-2018:2574-1 |
| SLES for SAP 12 SP3 | java-1_7_1-ibm | 1.7.1_sr4.30-38.26.1 | SUSE-SU-2018:2649-1 |
| SLES for SAP 12 SP3 | java-1_8_0-ibm | 1.8.0_sr5.20-30.36.1 | SUSE-SU-2018:2839-1 |
| SLES for SAP 12 SP2 | java-1_7_1-ibm | 1.7.1_sr4.30-38.26.1 | SUSE-SU-2018:2649-1 |
| SLES for SAP 12 SP2 | java-1_8_0-ibm | 1.8.0_sr5.20-30.36.1 | SUSE-SU-2018:2839-1 |
| SLES for SAP 12 SP1 | java-1_7_1-ibm | 1.7.1_sr4.30-38.26.1 | SUSE-SU-2018:2649-1 |
| SLES for SAP 12 SP1 | java-1_8_0-ibm | 1.8.0_sr5.20-30.36.1 | SUSE-SU-2018:2839-1 |
| SLES for SAP 11 SP4 | java-1_7_1-ibm | 1.7.1_sr4.30-26.29.1 | SUSE-SU-2018:2583-1 |
| SUSE OpenStack Cloud 7 | java-1_7_1-ibm | 1.7.1_sr4.30-38.26.1 | SUSE-SU-2018:2649-1 |
| SUSE OpenStack Cloud 7 | java-1_8_0-ibm | 1.8.0_sr5.20-30.36.1 | SUSE-SU-2018:2839-1 |
| SUSE Linux Enterprise Point of Sale 11 SP3 | java-1_7_0-ibm | 1.7.0_sr10.30-65.28.1 | SUSE-SU-2018:2574-1 |
| SUSE Enterprise Storage 4 | java-1_7_1-ibm | 1.7.1_sr4.30-38.26.1 | SUSE-SU-2018:2649-1 |
| SUSE Enterprise Storage 4 | java-1_8_0-ibm | 1.8.0_sr5.20-30.36.1 | SUSE-SU-2018:2839-1 |
Advisories 14
- RHSA-2018:2713 Red Hat Security Advisory: java-1.8.0-ibm security update Red Hat Security Advisories (RHSA) · Sep 21, 2026
- RHSA-2018:2568 Red Hat Security Advisory: java-1.8.0-ibm security update Red Hat Security Advisories (RHSA) · Sep 21, 2026
- RHSA-2018:2575 Red Hat Security Advisory: java-1.8.0-ibm security update Red Hat Security Advisories (RHSA) · Sep 21, 2026
- RHSA-2018:2712 Red Hat Security Advisory: java-1.7.1-ibm security update Red Hat Security Advisories (RHSA) · Jul 1, 2026
- RHSA-2018:2576 Red Hat Security Advisory: java-1.7.1-ibm security update Red Hat Security Advisories (RHSA) · Jul 1, 2026
- RHSA-2018:2569 Red Hat Security Advisory: java-1.7.1-ibm security update Red Hat Security Advisories (RHSA) · Jul 1, 2026
- SUSE-SU-2018:3082-1 Security update for java-1_8_0-ibm SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:2839-2 Security update for java-1_8_0-ibm SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:2574-1 Security update for java-1_7_0-ibm SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:2839-1 Security update for java-1_8_0-ibm SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:2583-1 Security update for java-1_7_1-ibm SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:2649-1 Security update for java-1_7_1-ibm SUSE / openSUSE Security Updates · May 2, 2025
- SUSE-SU-2018:2649-2 Security update for java-1_7_1-ibm SUSE / openSUSE Security Updates · May 2, 2025
- WID-SEC-2023-1594 IBM Tivoli Network Manager: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 28, 2023
References
- http://www.ibm.com/support/docview.wss?uid=ibm10719653
- ibm-java-cve20181656-file-overwrite(144882) vdb-entry
- RHSA-2018:2713 vendor-advisory
- 105118 vdb-entry
- RHSA-2018:2575 vendor-advisory
- RHSA-2018:2576 vendor-advisory
- RHSA-2018:2568 vendor-advisory
- RHSA-2018:2569 vendor-advisory
- RHSA-2018:2712 vendor-advisory
- 1041765 vdb-entry
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html