CVE-2018-1656

Description

The IBM Java Runtime Environment's Diagnostic Tooling Framework for Java (DTFJ) (IBM SDK, Java Technology Edition 6.0 , 7.0, and 8.0) does not protect against path traversal attacks when extracting compressed dump files. IBM X-Force ID: 144882.

Category

7.4
CVSS
Severity: High
CVSS 3.0 •
CVSS 2.0 •
EPSS 3.90% Top 15%
Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory ibm.com Vendor Advisory ibmcloud.com
Affected: IBM SDK, Java Technology Edition
Published at:
Updated at:

References

Link Tags
http://www.ibm.com/support/docview.wss?uid=ibm10719653 vendor advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/144882 vdb entry vendor advisory
https://access.redhat.com/errata/RHSA-2018:2713 third party advisory vendor advisory
http://www.securityfocus.com/bid/105118 vdb entry third party advisory
https://access.redhat.com/errata/RHSA-2018:2575 third party advisory vendor advisory
https://access.redhat.com/errata/RHSA-2018:2576 third party advisory vendor advisory
https://access.redhat.com/errata/RHSA-2018:2568 third party advisory vendor advisory
https://access.redhat.com/errata/RHSA-2018:2569 third party advisory vendor advisory
https://access.redhat.com/errata/RHSA-2018:2712 third party advisory vendor advisory
http://www.securitytracker.com/id/1041765 vdb entry third party advisory
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html third party advisory patch

Frequently Asked Questions

What is the severity of CVE-2018-1656?
CVE-2018-1656 has been scored as a high severity vulnerability.
How to fix CVE-2018-1656?
To fix CVE-2018-1656, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2018-1656 being actively exploited in the wild?
It is possible that CVE-2018-1656 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~4% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2018-1656?
CVE-2018-1656 affects IBM SDK, Java Technology Edition.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.