CVE-2018-1656

HIGH

7.4

CVSS Score

Published: August 20, 2018 at 09:00 PM UTC

Updated: June 17, 2026 at 01:51 AM UTC

7 products affected across 3 vendorsEnterprise Linux DesktopEnterprise Linux ServerEnterprise Linux Workstation

Using SDK, Java Technology Edition by IBM?

Get instant alerts when new vulnerabilities affect SDK, Java Technology Edition - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.4

Exploit prediction

EPSS 4%

Description

The IBM Java Runtime Environment's Diagnostic Tooling Framework for Java (DTFJ) (IBM SDK, Java Technology Edition 6.0 , 7.0, and 8.0) does not protect against path traversal attacks when extracting compressed dump files. IBM X-Force ID: 144882.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

SDK · IBMnpm

95%

6.0 7.0 8.0

Enterprise Manager Base Platform · Oracle

95%

13.2.0.0.0 13.3.0.0.0

Enterprise Linux Desktop · Red Hatrubygems

95%

6.0 7.0

Enterprise Linux Server · Red Hatrubygems

95%

6.0 7.0

Enterprise Linux Workstation · Red Hatrubygems

95%

6.0 7.0

Satellite · Red Hatrpm

95%

5.6 5.7 5.8

Java SDK · IBM

60%

6.0 7.0 8.0

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (11)

x_refsource_CONFIRMVendor Advisory

Source: [email protected]

http://www.ibm.com/support/docview.wss?uid=ibm10719653

VDB Entryx_refsource_BIDThird Party Advisory

Source: [email protected]

http://www.securityfocus.com/bid/105118

VDB Entryx_refsource_SECTRACKThird Party Advisory

Source: [email protected]

http://www.securitytracker.com/id/1041765