CVE-2019-4732
IBM SDK, Java Technology Edition Version 7.0.0.0 through 7.0.10.55, 7.1.0.0 through 7.1.4.55, and...
IBM SDK, Java Technology Edition Version 7.0.0.0 through 7.0.10.55, 7.1.0.0 through 7.1.4.55, and 8.0.0.0 through 8.0.6.0 could allow a local authenticated attacker to execute arbitrary code on the system, caused by DLL search order hijacking vulnerability in Microsoft Windows client. By placing a specially-crafted file in a compromised folder, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 172618.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- High
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
IBM SDK, Java Technology Edition Version 7.0.0.0 through 7.0.10.55, 7.1.0.0 through 7.1.4.55, and 8.0.0.0 through 8.0.6.0 could allow a local authenticated attacker to execute arbitrary code on the system, caused by DLL search order hijacking vulnerability in Microsoft Windows client. By placing a specially-crafted file in a compromised folder, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 172618.
- Record
CVE-2019-4732- CVSS 3.0
- 7.2 High
CVSS:3.0/AC:H/AV:L/PR:H/I:H/C:H/A:H/S:C/UI:R/E:U/RC:C/RL:O - Updated
- 2026-11-02
EUVDEUVD-2019-14339
IBM SDK, Java Technology Edition Version 7.0.0.0 through 7.0.10.55, 7.1.0.0 through 7.1.4.55, and 8.0.0.0 through 8.0.6.0 could allow a local authenticated attacker to execute arbitrary code on the system, caused by DLL search order hijacking vulnerability in Microsoft Windows client. By placing a specially-crafted file in a compromised folder, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 172618.
- Record
EUVD-2019-14339- CVSS 3.0
- 7.2 High
CVSS:3.0/AC:H/AV:L/PR:H/I:H/C:H/A:H/S:C/UI:R/E:U/RC:C/RL:O - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-764v-x3h3-f6pj No score
IBM SDK, Java Technology Edition Version 7.0.0.0 through 7.0.10.55, 7.1.0.0 through 7.1.4.55, and...
IBM SDK, Java Technology Edition Version 7.0.0.0 through 7.0.10.55, 7.1.0.0 through 7.1.4.55, and 8.0.0.0 through 8.0.6.0 could allow a local authenticated attacker to execute arbitrary code on the system, caused by DLL search order hijacking vulnerability in Microsoft Windows client. By placing a specially-crafted file in a compromised folder, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 172618.
- Record
GHSA-764v-x3h3-f6pj- Updated
- 2026-11-02
NVD
IBM SDK, Java Technology Edition Version 7.0.0.0 through 7.0.10.55, 7.1.0.0 through 7.1.4.55, and 8.0.0.0 through 8.0.6.0 could allow a local authenticated attacker to execute arbitrary code on the system, caused by DLL search order hijacking vulnerability in Microsoft Windows client. By placing a specially-crafted file in a compromised folder, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 172618.
- Record
CVE-2019-4732- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H - CVSS 3.0
- 7.2 High
CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H - CVSS 2.0
- 6.9 Medium
AV:L/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-426
- Updated
- 2026-11-02
OSVSUSE-SU-2020:0466-1 No score
Security update for java-1_8_0-ibm
This update for java-1_8_0-ibm fixes the following issues:
Java 8.0 was updated to Service Refresh 6 Fix Pack 5 (bsc#1162972, bsc#1160968)
- CVE-2020-2583: Unlink Set of LinkedHashSets
- CVE-2019-4732: Untrusted DLL search path vulnerability
- CVE-2020-2593: Normalize normalization for all
- CVE-2020-2604: Better serial filter handling
- CVE-2020-2659: Enhance datagram socket support
- Record
SUSE-SU-2020:0466-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:0528-1 No score
Security update for java-1_8_0-ibm
This update for java-1_8_0-ibm fixes the following issues:
Java 8.0 was updated to Service Refresh 6 Fix Pack 5 (bsc#1162972, bsc#1160968)
- CVE-2020-2583: Unlink Set of LinkedHashSets
- CVE-2019-4732: Untrusted DLL search path vulnerability
- CVE-2020-2593: Normalize normalization for all
- CVE-2020-2604: Better serial filter handling
- CVE-2020-2659: Enhance datagram socket support
- Record
SUSE-SU-2020:0528-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
java-1_8_0-ibmSUSE:Linux Enterprise Module for Legacy 15 From an advisory covering 5 CVEs |
before 1.8.0_sr6.5-3.33.2 | 1.8.0_sr6.5-3.33.2 |
java-1_8_0-ibmSUSE:Linux Enterprise Module for Legacy 15 SP1 From an advisory covering 5 CVEs |
before 1.8.0_sr6.5-3.33.2 | 1.8.0_sr6.5-3.33.2 |
java-1_8_0-ibmSUSE:Linux Enterprise Server 15-LTSS From an advisory covering 5 CVEs |
before 1.8.0_sr6.5-3.33.2 | 1.8.0_sr6.5-3.33.2 |
java-1_8_0-ibmSUSE:Linux Enterprise Server for SAP Applications 15 From an advisory covering 5 CVEs |
before 1.8.0_sr6.5-3.33.2 | 1.8.0_sr6.5-3.33.2 |
java-1_8_0-ibmSUSE:HPE Helion OpenStack 8 From an advisory covering 5 CVEs |
before 1.8.0_sr6.5-30.63.1 | 1.8.0_sr6.5-30.63.1 |
java-1_8_0-ibmSUSE:OpenStack Cloud 7 From an advisory covering 5 CVEs |
before 1.8.0_sr6.5-30.63.1 | 1.8.0_sr6.5-30.63.1 |
java-1_8_0-ibmSUSE:OpenStack Cloud 8 From an advisory covering 5 CVEs |
before 1.8.0_sr6.5-30.63.1 | 1.8.0_sr6.5-30.63.1 |
java-1_8_0-ibmSUSE:OpenStack Cloud Crowbar 8 From an advisory covering 5 CVEs |
before 1.8.0_sr6.5-30.63.1 | 1.8.0_sr6.5-30.63.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server for SAP Applications 12 SP1 From an advisory covering 5 CVEs |
before 1.8.0_sr6.5-30.63.1 | 1.8.0_sr6.5-30.63.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server for SAP Applications 12 SP2 From an advisory covering 5 CVEs |
before 1.8.0_sr6.5-30.63.1 | 1.8.0_sr6.5-30.63.1 |
Show 13 moreShow less
| Package | Affected | Fixed |
|---|---|---|
java-1_8_0-ibmSUSE:Linux Enterprise Server for SAP Applications 12 SP3 From an advisory covering 5 CVEs |
before 1.8.0_sr6.5-30.63.1 | 1.8.0_sr6.5-30.63.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Software Development Kit 12 SP4 From an advisory covering 5 CVEs |
before 1.8.0_sr6.5-30.63.1 | 1.8.0_sr6.5-30.63.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Software Development Kit 12 SP5 From an advisory covering 5 CVEs |
before 1.8.0_sr6.5-30.63.1 | 1.8.0_sr6.5-30.63.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server 12 SP1-LTSS From an advisory covering 5 CVEs |
before 1.8.0_sr6.5-30.63.1 | 1.8.0_sr6.5-30.63.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server 12 SP2-LTSS From an advisory covering 5 CVEs |
before 1.8.0_sr6.5-30.63.1 | 1.8.0_sr6.5-30.63.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server 12 SP2-BCL From an advisory covering 5 CVEs |
before 1.8.0_sr6.5-30.63.1 | 1.8.0_sr6.5-30.63.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server 12 SP3-LTSS From an advisory covering 5 CVEs |
before 1.8.0_sr6.5-30.63.1 | 1.8.0_sr6.5-30.63.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server 12 SP3-BCL From an advisory covering 5 CVEs |
before 1.8.0_sr6.5-30.63.1 | 1.8.0_sr6.5-30.63.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server 12 SP4 From an advisory covering 5 CVEs |
before 1.8.0_sr6.5-30.63.1 | 1.8.0_sr6.5-30.63.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server for SAP Applications 12 SP4 From an advisory covering 5 CVEs |
before 1.8.0_sr6.5-30.63.1 | 1.8.0_sr6.5-30.63.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server 12 SP5 From an advisory covering 5 CVEs |
before 1.8.0_sr6.5-30.63.1 | 1.8.0_sr6.5-30.63.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server for SAP Applications 12 SP5 From an advisory covering 5 CVEs |
before 1.8.0_sr6.5-30.63.1 | 1.8.0_sr6.5-30.63.1 |
java-1_8_0-ibmSUSE:Enterprise Storage 5 From an advisory covering 5 CVEs |
before 1.8.0_sr6.5-30.63.1 | 1.8.0_sr6.5-30.63.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases, products, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-4732 is a high vulnerability (CVSS 7.2) in Ibm Java, published February 3, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.54%, the 45th percentile. No source names a fixed version.