CVE-2019-4732
IBM SDK, Java Technology Edition Version 7.0.0.0 through 7.0.10.55, 7.1.0.0 through 7.1.4.55, and...
IBM SDK, Java Technology Edition Version 7.0.0.0 through 7.0.10.55, 7.1.0.0 through 7.1.4.55, and 8.0.0.0 through 8.0.6.0 could allow a local authenticated attacker to execute arbitrary code on the system, caused by DLL search order hijacking vulnerability in Microsoft Windows client. By placing a specially-crafted file in a compromised folder, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 172618.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- High
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
IBM SDK, Java Technology Edition Version 7.0.0.0 through 7.0.10.55, 7.1.0.0 through 7.1.4.55, and 8.0.0.0 through 8.0.6.0 could allow a local authenticated attacker to execute arbitrary code on the system, caused by DLL search order hijacking vulnerability in Microsoft Windows client. By placing a specially-crafted file in a compromised folder, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 172618.
- Record
CVE-2019-4732- CVSS 3.0
- 7.2 High
CVSS:3.0/AC:H/AV:L/PR:H/I:H/C:H/A:H/S:C/UI:R/E:U/RC:C/RL:O - Updated
- 2026-11-02
EUVDEUVD-2019-14339
IBM SDK, Java Technology Edition Version 7.0.0.0 through 7.0.10.55, 7.1.0.0 through 7.1.4.55, and 8.0.0.0 through 8.0.6.0 could allow a local authenticated attacker to execute arbitrary code on the system, caused by DLL search order hijacking vulnerability in Microsoft Windows client. By placing a specially-crafted file in a compromised folder, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 172618.
- Record
EUVD-2019-14339- CVSS 3.0
- 7.2 High
CVSS:3.0/AC:H/AV:L/PR:H/I:H/C:H/A:H/S:C/UI:R/E:U/RC:C/RL:O - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-764v-x3h3-f6pj No score
IBM SDK, Java Technology Edition Version 7.0.0.0 through 7.0.10.55, 7.1.0.0 through 7.1.4.55, and...
IBM SDK, Java Technology Edition Version 7.0.0.0 through 7.0.10.55, 7.1.0.0 through 7.1.4.55, and 8.0.0.0 through 8.0.6.0 could allow a local authenticated attacker to execute arbitrary code on the system, caused by DLL search order hijacking vulnerability in Microsoft Windows client. By placing a specially-crafted file in a compromised folder, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 172618.
- Record
GHSA-764v-x3h3-f6pj- Updated
- 2026-11-02
NVD
IBM SDK, Java Technology Edition Version 7.0.0.0 through 7.0.10.55, 7.1.0.0 through 7.1.4.55, and 8.0.0.0 through 8.0.6.0 could allow a local authenticated attacker to execute arbitrary code on the system, caused by DLL search order hijacking vulnerability in Microsoft Windows client. By placing a specially-crafted file in a compromised folder, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 172618.
- Record
CVE-2019-4732- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H - CVSS 3.0
- 7.2 High
CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H - CVSS 2.0
- 6.9 Medium
AV:L/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-426
- Updated
- 2026-11-02
OSVSUSE-SU-2020:0466-1 No score
Security update for java-1_8_0-ibm
This update for java-1_8_0-ibm fixes the following issues:
Java 8.0 was updated to Service Refresh 6 Fix Pack 5 (bsc#1162972, bsc#1160968)
- CVE-2020-2583: Unlink Set of LinkedHashSets
- CVE-2019-4732: Untrusted DLL search path vulnerability
- CVE-2020-2593: Normalize normalization for all
- CVE-2020-2604: Better serial filter handling
- CVE-2020-2659: Enhance datagram socket support
- Record
SUSE-SU-2020:0466-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:0528-1 No score
Security update for java-1_8_0-ibm
This update for java-1_8_0-ibm fixes the following issues:
Java 8.0 was updated to Service Refresh 6 Fix Pack 5 (bsc#1162972, bsc#1160968)
- CVE-2020-2583: Unlink Set of LinkedHashSets
- CVE-2019-4732: Untrusted DLL search path vulnerability
- CVE-2020-2593: Normalize normalization for all
- CVE-2020-2604: Better serial filter handling
- CVE-2020-2659: Enhance datagram socket support
- Record
SUSE-SU-2020:0528-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
java-1_8_0-ibmSUSE:Linux Enterprise Module for Legacy 15 |
before 1.8.0_sr6.5-3.33.2 | 1.8.0_sr6.5-3.33.2 |
java-1_8_0-ibmSUSE:Linux Enterprise Module for Legacy 15 SP1 |
before 1.8.0_sr6.5-3.33.2 | 1.8.0_sr6.5-3.33.2 |
java-1_8_0-ibmSUSE:Linux Enterprise Server 15-LTSS |
before 1.8.0_sr6.5-3.33.2 | 1.8.0_sr6.5-3.33.2 |
java-1_8_0-ibmSUSE:Linux Enterprise Server for SAP Applications 15 |
before 1.8.0_sr6.5-3.33.2 | 1.8.0_sr6.5-3.33.2 |
java-1_8_0-ibmSUSE:HPE Helion OpenStack 8 |
before 1.8.0_sr6.5-30.63.1 | 1.8.0_sr6.5-30.63.1 |
java-1_8_0-ibmSUSE:OpenStack Cloud 7 |
before 1.8.0_sr6.5-30.63.1 | 1.8.0_sr6.5-30.63.1 |
java-1_8_0-ibmSUSE:OpenStack Cloud 8 |
before 1.8.0_sr6.5-30.63.1 | 1.8.0_sr6.5-30.63.1 |
java-1_8_0-ibmSUSE:OpenStack Cloud Crowbar 8 |
before 1.8.0_sr6.5-30.63.1 | 1.8.0_sr6.5-30.63.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server for SAP Applications 12 SP1 |
before 1.8.0_sr6.5-30.63.1 | 1.8.0_sr6.5-30.63.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server for SAP Applications 12 SP2 |
before 1.8.0_sr6.5-30.63.1 | 1.8.0_sr6.5-30.63.1 |
Show 13 moreShow less
| Package | Affected | Fixed |
|---|---|---|
java-1_8_0-ibmSUSE:Linux Enterprise Server for SAP Applications 12 SP3 |
before 1.8.0_sr6.5-30.63.1 | 1.8.0_sr6.5-30.63.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Software Development Kit 12 SP4 |
before 1.8.0_sr6.5-30.63.1 | 1.8.0_sr6.5-30.63.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Software Development Kit 12 SP5 |
before 1.8.0_sr6.5-30.63.1 | 1.8.0_sr6.5-30.63.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server 12 SP1-LTSS |
before 1.8.0_sr6.5-30.63.1 | 1.8.0_sr6.5-30.63.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server 12 SP2-LTSS |
before 1.8.0_sr6.5-30.63.1 | 1.8.0_sr6.5-30.63.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server 12 SP2-BCL |
before 1.8.0_sr6.5-30.63.1 | 1.8.0_sr6.5-30.63.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server 12 SP3-LTSS |
before 1.8.0_sr6.5-30.63.1 | 1.8.0_sr6.5-30.63.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server 12 SP3-BCL |
before 1.8.0_sr6.5-30.63.1 | 1.8.0_sr6.5-30.63.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server 12 SP4 |
before 1.8.0_sr6.5-30.63.1 | 1.8.0_sr6.5-30.63.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server for SAP Applications 12 SP4 |
before 1.8.0_sr6.5-30.63.1 | 1.8.0_sr6.5-30.63.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server 12 SP5 |
before 1.8.0_sr6.5-30.63.1 | 1.8.0_sr6.5-30.63.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server for SAP Applications 12 SP5 |
before 1.8.0_sr6.5-30.63.1 | 1.8.0_sr6.5-30.63.1 |
java-1_8_0-ibmSUSE:Enterprise Storage 5 |
before 1.8.0_sr6.5-30.63.1 | 1.8.0_sr6.5-30.63.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, products, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-4732 is a high vulnerability (CVSS 7.2) in Ibm Java, published February 3, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.54%, the 45th percentile. Fixed in java-1_8_0-ibm 1.8.0_sr6.5-3.33.2.