CVE-2018-1656

Severity: medium (CVSS 6.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-08-20 · updated 2026-06-17
Weakness: CWE-22

Description

The IBM Java Runtime Environment's Diagnostic Tooling Framework for Java (DTFJ) (IBM SDK, Java Technology Edition 6.0 , 7.0, and 8.0) does not protect against path traversal attacks when extracting compressed dump files. IBM X-Force ID: 144882.

Affected products

IBM Sdk: 6.0, 7.0, 8.0
Oracle Corporation Enterprise Manager Base Platform: 13.2.0.0.0, 13.3.0.0.0
RedHat Enterprise Linux Desktop: 6.0, 7.0
RedHat Enterprise Linux Server: 6.0, 7.0
RedHat Enterprise Linux Workstation: 6.0, 7.0
Red Hat Satellite 6: 5.6, 5.7, 5.8

References

http://www.ibm.com/support/docview.wss?uid=ibm10719653
http://www.securityfocus.com/bid/105118
http://www.securitytracker.com/id/1041765
https://access.redhat.com/errata/RHSA-2018:2568
https://access.redhat.com/errata/RHSA-2018:2569
https://access.redhat.com/errata/RHSA-2018:2575
https://access.redhat.com/errata/RHSA-2018:2576
https://access.redhat.com/errata/RHSA-2018:2712
https://access.redhat.com/errata/RHSA-2018:2713
https://exchange.xforce.ibmcloud.com/vulnerabilities/144882
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
http://www.ibm.com/support/docview.wss?uid=ibm10719653

Get alerted when CVE-2018-1656 or the next vulnerability affects your stack