Every CVE Search/ Get API key

CVE-2019-4473

Multiple binaries in IBM SDK, Java Technology Edition 7, 7R, and 8 on the AIX platform use...

8.4 High

Multiple binaries in IBM SDK, Java Technology Edition 7, 7R, and 8 on the AIX platform use insecure absolute RPATHs, which may facilitate code injection and privilege elevation by local users. IBM X-Force ID: 163984.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.45%Down 2.1 points since Apr 14, 2021
90%50%10%1%

What each source reports

CVE List Score used 8.4

Multiple binaries in IBM SDK, Java Technology Edition 7, 7R, and 8 on the AIX platform use insecure absolute RPATHs, which may facilitate code injection and privilege elevation by local users. IBM X-Force ID: 163984.

Record
CVE-2019-4473
CVSS 3.0
8.4 HighCVSS:3.0/I:H/AC:L/A:H/C:H/UI:N/PR:N/AV:L/S:U/RL:O/RC:C/E:U
Updated
2026-11-02
EUVDEUVD-2019-14080 8.4

Multiple binaries in IBM SDK, Java Technology Edition 7, 7R, and 8 on the AIX platform use insecure absolute RPATHs, which may facilitate code injection and privilege elevation by local users. IBM X-Force ID: 163984.

Record
EUVD-2019-14080
CVSS 3.0
8.4 HighCVSS:3.0/I:H/AC:L/A:H/C:H/UI:N/PR:N/AV:L/S:U/RL:O/RC:C/E:U
Updated
2026-11-03
GitHub AdvisoriesGHSA-qh47-rvff-ggv7 7.8

Multiple binaries in IBM SDK, Java Technology Edition 7, 7R, and 8 on the AIX platform use...

Multiple binaries in IBM SDK, Java Technology Edition 7, 7R, and 8 on the AIX platform use insecure absolute RPATHs, which may facilitate code injection and privilege elevation by local users. IBM X-Force ID: 163984.

Record
GHSA-qh47-rvff-ggv7
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-427
Updated
2026-11-02
NVD 7.8

Multiple binaries in IBM SDK, Java Technology Edition 7, 7R, and 8 on the AIX platform use insecure absolute RPATHs, which may facilitate code injection and privilege elevation by local users. IBM X-Force ID: 163984.

Record
CVE-2019-4473
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.0
8.4 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
4.6 MediumAV:L/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-427
Updated
2026-11-02
OSVSUSE-SU-2019:14160-1 No score

Security update for java-1_7_1-ibm

This update for java-1_7_1-ibm fixes the following issues:

Update to Java 7.1 Service Refresh 4 Fix Pack 50.

Security issues fixed:

  • CVE-2019-11771: IBM Security Update July 2019 (bsc#1147021)
  • CVE-2019-11775: IBM Security Update July 2019 (bsc#1147021)
  • CVE-2019-4473: IBM Security Update July 2019 (bsc#1147021)
  • CVE-2019-7317: Fixed issue inside Component AWT (libpng)(bsc#1141780).
  • CVE-2019-2769: Fixed issue inside Component Utilities (bsc#1141783).
  • CVE-2019-2762: Fixed issue inside Component Utilities (bsc#1141782).
  • CVE-2019-2816: Fixed issue inside Component Networking (bsc#1141785).
  • CVE-2019-2766: Fixed issue inside Component Networking (bsc#1141789).
Record
SUSE-SU-2019:14160-1
Updated
2026-11-02
OSVSUSE-SU-2019:14188-1 No score

Security update for java-1_7_0-ibm

This update for java-1_7_0-ibm fixes the following issues:

Update to Java 7.0 Service Refresh 10 Fix Pack 50 (bsc#1147021).

Security issues fixed:

  • CVE-2019-2762: Fixed issue inside Component Utilities (bsc#1141782).
  • CVE-2019-2766: Fixed issue inside Component Networking (bsc#1141789).
  • CVE-2019-2769: Fixed issue inside Component Utilities (bsc#1141783).
  • CVE-2019-2816: Fixed issue inside Component Networking (bsc#1147021).
  • CVE-2019-4473: Fixed insecure RPATH in multiple binaries on AIX (bsc#1147021).
  • CVE-2019-7317: Fixed use-after-free in libpng, affecting client-libs/java.awt (bsc#1147021).
  • CVE-2019-11771: Fixed insecure RPATH in OpenJ9 on AIX (bsc#1147021).
  • CVE-2019-11775: Fixed failure to privatize a value pulled out of the loop by versioning (bsc#1147021).
Record
SUSE-SU-2019:14188-1
Updated
2026-11-02
OSVSUSE-SU-2019:2291-1 No score

Security update for java-1_8_0-ibm

This update for java-1_8_0-ibm fixes the following issues:

Update to Java 8.0 Service Refresh 5 Fix Pack 40.

Security issues fixed:

  • CVE-2019-11771: IBM Security Update July 2019 (bsc#1147021)
  • CVE-2019-11772: IBM Security Update July 2019 (bsc#1147021)
  • CVE-2019-11775: IBM Security Update July 2019 (bsc#1147021)
  • CVE-2019-4473: IBM Security Update July 2019 (bsc#1147021)
  • CVE-2019-7317: Fixed issue inside Component AWT (libpng)(bsc#1141780).
  • CVE-2019-2769: Fixed issue inside Component Utilities (bsc#1141783).
  • CVE-2019-2762: Fixed issue inside Component Utilities (bsc#1141782).
  • CVE-2019-2816: Fixed issue inside Component Networking (bsc#1141785).
  • CVE-2019-2766: Fixed issue inside Component Networking (bsc#1141789).
  • CVE-2019-2786: Fixed issue inside Component Security (bsc#1141787).
Record
SUSE-SU-2019:2291-1
Updated
2026-11-02
OSVSUSE-SU-2019:2336-1 No score

Security update for java-1_7_1-ibm

This update for java-1_7_1-ibm fixes the following issues:

Update to Java 7.1 Service Refresh 4 Fix Pack 50.

Security issues fixed:

  • CVE-2019-11771: IBM Security Update July 2019 (bsc#1147021)
  • CVE-2019-11775: IBM Security Update July 2019 (bsc#1147021)
  • CVE-2019-4473: IBM Security Update July 2019 (bsc#1147021)
  • CVE-2019-7317: Fixed issue inside Component AWT (libpng)(bsc#1141780).
  • CVE-2019-2769: Fixed issue inside Component Utilities (bsc#1141783).
  • CVE-2019-2762: Fixed issue inside Component Utilities (bsc#1141782).
  • CVE-2019-2816: Fixed issue inside Component Networking (bsc#1141785).
  • CVE-2019-2766: Fixed issue inside Component Networking (bsc#1141789).
Record
SUSE-SU-2019:2336-1
Updated
2026-11-02
OSVSUSE-SU-2019:2371-1 No score

Security update for java-1_8_0-ibm

This update for java-1_8_0-ibm fixes the following issues:

Update to Java 8.0 Service Refresh 5 Fix Pack 40.

Security issues fixed:

  • CVE-2019-11771: IBM Security Update July 2019 (bsc#1147021)
  • CVE-2019-11772: IBM Security Update July 2019 (bsc#1147021)
  • CVE-2019-11775: IBM Security Update July 2019 (bsc#1147021)
  • CVE-2019-4473: IBM Security Update July 2019 (bsc#1147021)
  • CVE-2019-7317: Fixed issue inside Component AWT (libpng)(bsc#1141780).
  • CVE-2019-2769: Fixed issue inside Component Utilities (bsc#1141783).
  • CVE-2019-2762: Fixed issue inside Component Utilities (bsc#1141782).
  • CVE-2019-2816: Fixed issue inside Component Networking (bsc#1141785).
  • CVE-2019-2766: Fixed issue inside Component Networking (bsc#1141789).
  • CVE-2019-2786: Fixed issue inside Component Security (bsc#1141787).
Record
SUSE-SU-2019:2371-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
java-1_7_1-ibm
SUSE:Linux Enterprise Server 11 SP4-LTSS
From an advisory covering 8 CVEs
 before 1.7.1_sr4.50-26.44.1
1.7.1_sr4.50-26.44.1
java-1_7_0-ibm
SUSE:Linux Enterprise Point of Sale 11 SP3
From an advisory covering 8 CVEs
 before 1.7.0_sr10.50-65.42.1
1.7.0_sr10.50-65.42.1
java-1_8_0-ibm
SUSE:Linux Enterprise Module for Legacy 15
From an advisory covering 12 CVEs
 before 1.8.0_sr5.40-3.24.1
1.8.0_sr5.40-3.24.1
java-1_8_0-ibm
SUSE:Linux Enterprise Module for Legacy 15 SP1
From an advisory covering 12 CVEs
 before 1.8.0_sr5.40-3.24.1
1.8.0_sr5.40-3.24.1
java-1_7_1-ibm
SUSE:HPE Helion OpenStack 8
From an advisory covering 8 CVEs
 before 1.7.1_sr4.50-38.41.1
1.7.1_sr4.50-38.41.1
java-1_7_1-ibm
SUSE:OpenStack Cloud 7
From an advisory covering 8 CVEs
 before 1.7.1_sr4.50-38.41.1
1.7.1_sr4.50-38.41.1
java-1_7_1-ibm
SUSE:OpenStack Cloud 8
From an advisory covering 8 CVEs
 before 1.7.1_sr4.50-38.41.1
1.7.1_sr4.50-38.41.1
java-1_7_1-ibm
SUSE:OpenStack Cloud Crowbar 8
From an advisory covering 8 CVEs
 before 1.7.1_sr4.50-38.41.1
1.7.1_sr4.50-38.41.1
java-1_7_1-ibm
SUSE:Linux Enterprise Server for SAP Applications 12 SP1
From an advisory covering 8 CVEs
 before 1.7.1_sr4.50-38.41.1
1.7.1_sr4.50-38.41.1
java-1_7_1-ibm
SUSE:Linux Enterprise Server for SAP Applications 12 SP2
From an advisory covering 8 CVEs
 before 1.7.1_sr4.50-38.41.1
1.7.1_sr4.50-38.41.1
Show 34 moreShow less
Affected packages
PackageAffectedFixed
java-1_7_1-ibm
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
From an advisory covering 8 CVEs
 before 1.7.1_sr4.50-38.41.1
1.7.1_sr4.50-38.41.1
java-1_7_1-ibm
SUSE:Linux Enterprise Software Development Kit 12 SP4
From an advisory covering 8 CVEs
 before 1.7.1_sr4.50-38.41.1
1.7.1_sr4.50-38.41.1
java-1_7_1-ibm
SUSE:Linux Enterprise Software Development Kit 12 SP5
From an advisory covering 8 CVEs
 before 1.7.1_sr4.50-38.41.1
1.7.1_sr4.50-38.41.1
java-1_7_1-ibm
SUSE:Linux Enterprise Server 12 SP1-LTSS
From an advisory covering 8 CVEs
 before 1.7.1_sr4.50-38.41.1
1.7.1_sr4.50-38.41.1
java-1_7_1-ibm
SUSE:Linux Enterprise Server 12 SP2-LTSS
From an advisory covering 8 CVEs
 before 1.7.1_sr4.50-38.41.1
1.7.1_sr4.50-38.41.1
java-1_7_1-ibm
SUSE:Linux Enterprise Server 12 SP2-BCL
From an advisory covering 8 CVEs
 before 1.7.1_sr4.50-38.41.1
1.7.1_sr4.50-38.41.1
java-1_7_1-ibm
SUSE:Linux Enterprise Server 12 SP3-LTSS
From an advisory covering 8 CVEs
 before 1.7.1_sr4.50-38.41.1
1.7.1_sr4.50-38.41.1
java-1_7_1-ibm
SUSE:Linux Enterprise Server 12 SP3-BCL
From an advisory covering 8 CVEs
 before 1.7.1_sr4.50-38.41.1
1.7.1_sr4.50-38.41.1
java-1_7_1-ibm
SUSE:Linux Enterprise Server 12 SP4
From an advisory covering 8 CVEs
 before 1.7.1_sr4.50-38.41.1
1.7.1_sr4.50-38.41.1
java-1_7_1-ibm
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
From an advisory covering 8 CVEs
 before 1.7.1_sr4.50-38.41.1
1.7.1_sr4.50-38.41.1
java-1_7_1-ibm
SUSE:Linux Enterprise Server 12 SP5
From an advisory covering 8 CVEs
 before 1.7.1_sr4.50-38.41.1
1.7.1_sr4.50-38.41.1
java-1_7_1-ibm
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
From an advisory covering 8 CVEs
 before 1.7.1_sr4.50-38.41.1
1.7.1_sr4.50-38.41.1
java-1_7_1-ibm
SUSE:Enterprise Storage 4
From an advisory covering 8 CVEs
 before 1.7.1_sr4.50-38.41.1
1.7.1_sr4.50-38.41.1
java-1_7_1-ibm
SUSE:Enterprise Storage 5
From an advisory covering 8 CVEs
 before 1.7.1_sr4.50-38.41.1
1.7.1_sr4.50-38.41.1
java-1_8_0-ibm
SUSE:HPE Helion OpenStack 8
From an advisory covering 12 CVEs
 before 1.8.0_sr5.40-30.54.1
1.8.0_sr5.40-30.54.1
java-1_8_0-ibm
SUSE:OpenStack Cloud 7
From an advisory covering 12 CVEs
 before 1.8.0_sr5.40-30.54.1
1.8.0_sr5.40-30.54.1
java-1_8_0-ibm
SUSE:OpenStack Cloud 8
From an advisory covering 12 CVEs
 before 1.8.0_sr5.40-30.54.1
1.8.0_sr5.40-30.54.1
java-1_8_0-ibm
SUSE:OpenStack Cloud Crowbar 8
From an advisory covering 12 CVEs
 before 1.8.0_sr5.40-30.54.1
1.8.0_sr5.40-30.54.1
java-1_8_0-ibm
SUSE:Linux Enterprise Server for SAP Applications 12 SP1
From an advisory covering 12 CVEs
 before 1.8.0_sr5.40-30.54.1
1.8.0_sr5.40-30.54.1
java-1_8_0-ibm
SUSE:Linux Enterprise Server for SAP Applications 12 SP2
From an advisory covering 12 CVEs
 before 1.8.0_sr5.40-30.54.1
1.8.0_sr5.40-30.54.1
java-1_8_0-ibm
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
From an advisory covering 12 CVEs
 before 1.8.0_sr5.40-30.54.1
1.8.0_sr5.40-30.54.1
java-1_8_0-ibm
SUSE:Linux Enterprise Software Development Kit 12 SP4
From an advisory covering 12 CVEs
 before 1.8.0_sr5.40-30.54.1
1.8.0_sr5.40-30.54.1
java-1_8_0-ibm
SUSE:Linux Enterprise Software Development Kit 12 SP5
From an advisory covering 12 CVEs
 before 1.8.0_sr5.40-30.54.1
1.8.0_sr5.40-30.54.1
java-1_8_0-ibm
SUSE:Linux Enterprise Server 12 SP1-LTSS
From an advisory covering 12 CVEs
 before 1.8.0_sr5.40-30.54.1
1.8.0_sr5.40-30.54.1
java-1_8_0-ibm
SUSE:Linux Enterprise Server 12 SP2-LTSS
From an advisory covering 12 CVEs
 before 1.8.0_sr5.40-30.54.1
1.8.0_sr5.40-30.54.1
java-1_8_0-ibm
SUSE:Linux Enterprise Server 12 SP2-BCL
From an advisory covering 12 CVEs
 before 1.8.0_sr5.40-30.54.1
1.8.0_sr5.40-30.54.1
java-1_8_0-ibm
SUSE:Linux Enterprise Server 12 SP3-LTSS
From an advisory covering 12 CVEs
 before 1.8.0_sr5.40-30.54.1
1.8.0_sr5.40-30.54.1
java-1_8_0-ibm
SUSE:Linux Enterprise Server 12 SP3-BCL
From an advisory covering 12 CVEs
 before 1.8.0_sr5.40-30.54.1
1.8.0_sr5.40-30.54.1
java-1_8_0-ibm
SUSE:Linux Enterprise Server 12 SP4
From an advisory covering 12 CVEs
 before 1.8.0_sr5.40-30.54.1
1.8.0_sr5.40-30.54.1
java-1_8_0-ibm
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
From an advisory covering 12 CVEs
 before 1.8.0_sr5.40-30.54.1
1.8.0_sr5.40-30.54.1
java-1_8_0-ibm
SUSE:Linux Enterprise Server 12 SP5
From an advisory covering 12 CVEs
 before 1.8.0_sr5.40-30.54.1
1.8.0_sr5.40-30.54.1
java-1_8_0-ibm
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
From an advisory covering 12 CVEs
 before 1.8.0_sr5.40-30.54.1
1.8.0_sr5.40-30.54.1
java-1_8_0-ibm
SUSE:Enterprise Storage 4
From an advisory covering 12 CVEs
 before 1.8.0_sr5.40-30.54.1
1.8.0_sr5.40-30.54.1
java-1_8_0-ibm
SUSE:Enterprise Storage 5
From an advisory covering 12 CVEs
 before 1.8.0_sr5.40-30.54.1
1.8.0_sr5.40-30.54.1

History

History
RecordedChangedSources
affected, facts
aliases, products, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-4473 is a high vulnerability (CVSS 8.4) in Ibm Java, published August 5, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.45%, the 39th percentile. No source names a fixed version.

References

Show 24 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open